Description

The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip and only verifies the 'ajax-nonce' nonce, which is emitted on every admin page via wp_localize_script (unrestricted admin_enqueue_scripts hook) and is therefore accessible to any authenticated user including Subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to wipe navigation menus, sidebar widgets (via update_option('sidebars_widgets', array())), all theme mods (via remove_theme_mods()), and Elementor templates, as well as trigger arbitrary demo-content imports.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-16T06:16:51.683Z",
  "pubdate": "2026-08-16T06:16:51.683Z",
  "executiveSummary": "The Solace Extra plugin for WordPress, in versions up to and including 1.6.0, suffers from an unauthorized modification and loss of data vulnerability caused by a missing capability check. The security flaw allows authenticated attackers, specifically users with Subscriber-level access and above, to invoke administrative functions and execute high-impact actions. The vulnerability stems from improper access control mechanisms within AJAX action handlers exposed by the plugin. Attackers can exploit this issue to trigger arbitrary demo-content imports, wipe navigation menus, delete sidebar widgets, remove all theme modifications, and destroy Elementor templates. The risk implication is severe, as low-privileged users can cause widespread data destruction and unauthorized state changes across the target WordPress installation without requiring elevated administrative privileges. Exploitation requires the attacker to be authenticated as at least a Subscriber, leveraging a widely exposed AJAX nonce that is accessible on every administrative page. No complex prerequisites are needed beyond standard user registration on the vulnerable WordPress site.",
  "technicalDetails": "The vulnerability resides within the Solace Extra plugin for WordPress, specifically affecting versions up to and including 1.6.0. The root cause of the security defect is the absence of a proper capability check, such as current_user_can(), inside the import_zip() function. This vulnerable function acts as the backend handler for AJAX requests and is explicitly registered on both the wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip action hooks. Consequently, the endpoint is exposed to both authenticated and unauthenticated contexts, though authentication is practically leveraged through the nonce validation mechanism.\nThe authentication and authorization weakness is compounded by how the plugin handles the 'ajax-nonce' nonce. The required 'ajax-nonce' is emitted on every administrative page via the wp_localize_script function through an unrestricted admin_enqueue_scripts hook. Because this nonce is rendered globally across administrative interfaces, it is easily accessible to any authenticated user, including those restricted to Subscriber-level access. When a request is dispatched to the vulnerable AJAX endpoint, the implementation only validates the presence and validity of the 'ajax-nonce' without verifying whether the requesting user actually possesses administrative privileges.\nThe attack flow proceeds as follows: an authenticated attacker with Subscriber-level access navigates to an administrative context or extracts the globally exposed 'ajax-nonce' from the page source. The attacker then crafts and submits an HTTP POST request targeting the WordPress AJAX endpoint with the action parameter set to action-import-zip, supplying the harvested 'ajax-nonce'. Because the import_zip() function lacks authorization checks, the application processes the request. The payload behavior triggers a series of destructive operations, including wiping navigation menus, resetting sidebar widgets via update_option('sidebars_widgets', array()), stripping all theme mods via remove_theme_mods(), destroying Elementor templates, and executing arbitrary demo-content imports. The post-exploitation impact includes severe data loss, persistent denial of service regarding site styling and layout, and integrity compromise of the WordPress instance."
}