CVE-2026-16965

Name of the Vulnerable Software and Affected Versions Solace Extra versions prior to 1.6.1

Description The Solace Extra WordPress plugin fails to perform capability or nonce checks in an AJAX action. This allows any authenticated user, including those with subscriber privileges, to update post meta on arbitrary posts and deactivate the active site templates. This can be achieved directly by an authenticated user or via Cross-Site Request Forgery (CSRF), where a logged-in user is tricked into performing the action. The issue is located in the solace update sitebuilder status action.

Recommendations Update Solace Extra to version 1.6.1 or later.