CVE-2026-13250

Name of the Vulnerable Software and Affected Versions Solace Extra plugin for WordPress versions prior to 1.5.4

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to permanently delete all content imported through the Starter Template feature, such as posts, pages, media attachments, WooCommerce products, taxonomy terms, and sitebuilder templates. The issue occurs because the required nonce is emitted on every wp-admin page via wp localize script() hooked to admin enqueue scripts without a page guard, allowing any Subscriber visiting /wp-admin/profile.php to obtain it. Furthermore, the handler is registered via wp ajax nopriv , making the functionality accessible to fully unauthenticated users.

Recommendations Update the plugin to a version newer than 1.5.3.