CVE-2026-16966
Received Received - Intake

Unauthenticated Access to Non-Published Site Builder Parts in Solace WordPress Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-16966
EUVD
EUVD-2026-69867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
solace_extra solace_extra_wordpress_plugin to 1.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Solace Extra WordPress plugin before version 1.7.0. It allows unauthenticated users to read unpublished Site Builder content such as drafts, pending posts, private pages, or trashed items via an AJAX action that lacks proper authorization checks. WordPress normally restricts access to this content.

Detection Guidance

Check the installed version of the Solace Extra WordPress plugin. If it is below 1.7.0, the vulnerability is likely present. You can verify this via the WordPress admin panel under Plugins or by inspecting the plugin files on the server.

Impact Analysis

Unauthenticated attackers could access sensitive unpublished content on your WordPress site, including draft posts, private pages, or trashed items. This could lead to data leaks, intellectual property theft, or exposure of confidential information before it is ready for public release.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing unpublished sensitive data such as drafts containing personal or health information. Unauthorized access to such data may result in non-compliance with data protection requirements, leading to legal penalties or reputational damage.

Mitigation Strategies

Update the Solace Extra WordPress plugin to version 1.7.0 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16966. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart