Security Alert Summary
The Solace Extra WordPress plugin (versions before 1.7.0) contains an issue in one of its AJAX actions that fails to perform authorization and post-status checks. This allows unauthenticated visitors to read the content of non-published Site Builder parts (draft, pending, private, and trashed) that WordPress would normally not serve.
CVE Details
- CVE ID: CVE-2026-16966
- Affected component: Solace Extra WordPress plugin
- Affected versions: versions before 1.7.0
- Published: September 2, 2026 6:17:16 AM UTC
- Last modified: September 2, 2026 11:17:18 AM UTC
- CVSS v3.1: Base score 5.3, MEDIUM; Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Authentication / privileges / user interaction: No authentication required (PR:N); no user interaction required (UI:N)
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- CWE / weakness: CWE-200 (Exposure of Sensitive Information)
Technical Details
According to the advisory, the plugin does not perform any authorization or post-status checks in one of its AJAX actions. Because the check is missing, unauthenticated requests to that AJAX action can return the stored content of Site Builder parts that are not published, including drafts, pending items, private content, and trashed items. The issue is rooted in a lack of access control on the server-side handler for that AJAX action rather than a flaw in WordPress core.
The advisory does not name specific function names or REST endpoints; it specifically references an “AJAX action” within the plugin that fails to verify requester permissions and the post status before returning content. The practical impact is limited to disclosure of content that would otherwise be restricted by post status checks.
How This Could Impact Your Website
In a typical site workflow, the site owner and internal staff use drafts and private Site Builder parts to prepare content before publication, and external contractors or contributors may be given limited editing access. If an unauthenticated attacker can read non-published parts, they might obtain internal content such as unpublished page drafts, staging notes, or other material that was not intended for public view.
Realistic consequences include exposure of internal content and contact information, which can increase the risk of targeted phishing or social engineering against staff and contractors. The measured CVSS impacts indicate a limited confidentiality exposure rather than site takeover; integrity and availability are not indicated as affected. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and external contractors.
- Enforce strong passwords and two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual access patterns to AJAX endpoints or requests for unpublished content.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
