Solace Extra

Solace Extra before 1.7.0 omits authorization and post-status checks from an AJAX action. An unauthenticated visitor can read draft, pending, private, and trashed Site Builder parts that WordPress would not otherwise serve.

Solace Extra through 1.6.0 registers import_zip() on action-import-zip AJAX hooks and checks only ajax-nonce. That nonce is localized on every admin page without restricting admin_enqueue_scripts, so a Subscriber can obtain it. The attacker can then erase navigation menus, sidebar widgets, all theme modifications and Elementor templates, or trigger arbitrary demo-content imports. The complete import archive format and request parameters are not disclosed.

Solace Extra is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 1.6.0.

Solace Extra before 1.6.1 exposes an AJAX action without capability or nonce checks. Any authenticated user, including a Subscriber, can update post metadata on arbitrary posts and deactivate the site's active templates. Because the action lacks a nonce, an attacker can also induce any logged-in user to submit the request through cross-site request forgery.

Solace Extra before 1.6.1 protects several admin-ajax.php actions with shared or admin-page nonces but does not enforce an administrator capability. Because low-privileged users can reach pages exposing those nonces, a Subscriber can invoke update_solace_font_and_color, update_logo2, update_sol_color_base_font_elementor_system_color and solace_update_sitebuilder_status with attacker-controlled font, color, logo_url, post_id, status and part values. The callbacks update theme modifications, Elementor kit settings or site-builder post metadata, enabling site-wide presentation changes and destructive changes to imported site-builder content. Version 1.6.1 adds manage_options checks and an action-specific nonce for the site-builder status operation.

Solace Extra is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.5.3.

Solace Extra is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

Solace Extra is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

Solace Extra is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.