Solace Extra import_zip lets Subscribers erase site configuration
Solace Extra through 1.6.0 registers import_zip() on action-import-zip AJAX hooks and checks only ajax-nonce. That nonce is localized on every admin page without restricting admin_enqueue_scripts, so a Subscriber can obtain it. The attacker can then erase navigation menus, sidebar widgets, all theme modifications and Elementor templates, or trigger arbitrary demo-content imports. The complete import archive format and request parameters are not disclosed.
- Component
- Solace Extra
- Plugin slug
solace-extra- Affected
- <= 1.6.0
- Safe version
- See mitigation notes
- Published
- Aug 16, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 16, 2026 and is one of 9 known issues for this plugin.
Update, patch or deactivate.
No fixed release is identified in the authoritative record. Update when a confirmed patch is available; until then, deactivate Solace Extra when warranted, restrict untrusted accounts, and preserve or restore menus, widgets, theme settings, and templates from known-good backups. The official upstream changelog lists version 1.6.2, which is newer than the published affected range. Its changelog does not clearly confirm this specific fix, so it is not counted as a known-safe release.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip and only verifies the 'ajax-nonce' nonce, which is emitted on every admin page via wp_localize_script (unrestricted admin_enqueue_scripts hook) and is therefore accessible to any authenticated user including Subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to wipe navigation menus, sidebar widgets (via update_option('sidebars_widgets', array())), all theme mods (via remove_theme_mods()), and Elementor templates, as well as trigger arbitrary demo-content imports.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H