PT-2026-84607 · WordPress · Solace Extra
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Solace Extra WordPress plugin versions prior to 1.7.0
Description
An issue exists where the plugin fails to perform authorization or post-status checks within an AJAX action. This allows unauthenticated visitors to access and read the content of Site Builder parts that are not published, including those with statuses such as draft, pending, private, or trashed, which are normally restricted by WordPress.
Recommendations
Update Solace Extra WordPress plugin to version 1.7.0 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Solace Extra