Description

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:16.447Z",
  "pubdate": "2026-09-02T06:17:16.447Z",
  "executiveSummary": "The Solace Extra WordPress plugin, in versions prior to 1.7.0, suffers from an Improper Authorization vulnerability within its AJAX action handling mechanisms.\nThis security flaw allows unauthenticated, remote attackers to access sensitive information by retrieving Site Builder parts that are currently in a non-published status, such as drafts, pending, private, or trashed content.\nThe vulnerability stems from a failure to perform adequate capability checks or post-status validation before processing requests.\nThe primary risk implication is unauthorized information disclosure of potentially sensitive internal or work-in-progress content.\nNo authentication or specific privileges are required to exploit this flaw, as the vulnerable endpoint is accessible to any unauthenticated visitor.\nAttackers can leverage this vulnerability to gain visibility into non-public site structures, business secrets, or pre-publication drafts, which would otherwise be restricted by WordPress core access control mechanisms.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of AJAX handlers within the Solace Extra plugin. Specifically, the plugin provides an AJAX action intended for retrieving Site Builder components that lacks mandatory security verification procedures. In standard WordPress development, AJAX actions that return sensitive data or internal content must utilize internal hooks such as 'check_ajax_referer' for CSRF protection and verify user capabilities via 'current_user_can()' to ensure the requesting user has the appropriate authorization level to view the requested resource.\nThe affected component does not validate the status of the requested Site Builder part. WordPress content objects, such as posts or custom post types, have distinct post statuses (e.g., 'publish', 'draft', 'pending', 'private', 'trash'). The plugin's AJAX handler fails to check if the post status of the retrieved object is 'publish' before outputting the content to the client. Consequently, any HTTP request directed at the specific AJAX action with the appropriate parameter (typically an ID reference to the Site Builder part) bypasses the default WordPress visibility logic.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies the AJAX action endpoint exposed by the Solace Extra plugin. Second, the attacker crafts a malicious HTTP GET or POST request containing the AJAX action name and the ID of a target Site Builder part. Third, because the backend code lacks an authorization gate, the server processes the request and executes a database query to retrieve the object. Fourth, the plugin serializes the object data—which may contain internal configurations, draft text, or private layouts—and transmits it directly back to the attacker in the HTTP response body.\nThis vulnerability is classified as an Information Disclosure issue. Because it is reachable over the network without authentication, the attack surface includes any public-facing installation of the Solace Extra plugin. Post-exploitation impact involves the exposure of proprietary site design components, intellectual property, or sensitive staging data, which could be utilized for further reconnaissance or competitive intelligence gathering against the WordPress installation."
}