Medium severity · published Aug 9, 2026
CVE-2026-16965
Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status
4.3
CVSS
0.1%
EPSS
No
On KEV
Description
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Solace Extra ·
before 1.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16965
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16965
wpscan.com
https://wpscan.com/vulnerability/514f4577-1f7e-4d50-90d5-36bc504a260c/
More from Solace Extra
8.1
CVE-2026-16948
Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
5.3
CVE-2026-80333
Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
5.3
CVE-2026-16966
Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content