CVE-2026-80333
Received Received - Intake

Unauthenticated Post Content Exposure in Solace WordPress Plugin

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: WPScan

Description
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-80333
EUVD
EUVD-2026-89636

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
solace_extra plugin to 1.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Solace Extra WordPress plugin before version 1.7.2 has a flaw where it does not check if users are authorized or if posts are published before allowing access to preview routes. This lets unauthenticated visitors view the content of non-published posts or pages that WordPress normally restricts.

Detection Guidance

Check if the Solace Extra WordPress plugin version is below 1.7.2. Inspect server logs for unauthorized access attempts to preview routes or non-published content. Use WordPress admin panel to verify post visibility settings for unexpected public access.

Impact Analysis

This vulnerability could expose sensitive or unpublished content to unauthorized users, potentially leaking confidential information, drafts, or private pages. Attackers might use this to gather data before it is ready for public release.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. Unauthorized exposure of non-published content may violate these regulations.

Mitigation Strategies

Update the Solace Extra plugin to version 1.7.2 or later immediately. Review and restrict access to preview routes if custom configurations exist. Monitor for unusual access patterns in server logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80333. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart