CVE-2026-16966

Name of the Vulnerable Software and Affected Versions Solace Extra WordPress plugin versions prior to 1.7.0

Description An issue exists where the plugin fails to perform authorization or post-status checks within an AJAX action. This allows unauthenticated visitors to access and read the content of Site Builder parts that are not published, including those with statuses such as draft, pending, private, or trashed, which are normally restricted by WordPress.

Recommendations Update Solace Extra WordPress plugin to version 1.7.0 or later.