Solace Extra AJAX actions let Subscribers alter presentation settings and imported site-builder content
Solace Extra before 1.6.1 protects several admin-ajax.php actions with shared or admin-page nonces but does not enforce an administrator capability. Because low-privileged users can reach pages exposing those nonces, a Subscriber can invoke update_solace_font_and_color, update_logo2, update_sol_color_base_font_elementor_system_color and solace_update_sitebuilder_status with attacker-controlled font, color, logo_url, post_id, status and part values. The callbacks update theme modifications, Elementor kit settings or site-builder post metadata, enabling site-wide presentation changes and destructive changes to imported site-builder content. Version 1.6.1 adds manage_options checks and an action-specific nonce for the site-builder status operation.
- Component
- Solace Extra
- Plugin slug
solace-extra- Affected
- < 1.6.1
- Safe version
1.6.1- Published
- Aug 08, 2026
This CVE was published Aug 08, 2026 and is one of 9 known issues for this plugin.
Update, patch or deactivate.
Update to 1.6.1 or later. Review theme modifications, Elementor global styles and logo settings, and imported header, footer and site-builder status for unauthorized changes; restore affected imported content from a known-good backup.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H