High severity · published Aug 8, 2026
CVE-2026-16948
Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Solace Extra ·
before 1.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16948
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16948
wpscan.com
https://wpscan.com/vulnerability/50e47ee9-cffc-4435-bc77-77fc65e9ff16/
More from Solace Extra
5.3
CVE-2026-80333
Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
5.3
CVE-2026-16966
Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content
4.3
CVE-2026-16965
Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status