CVE-2026-16965CWE-352CWE-862broken-access-controlcsrf
CVE-2026-16965
Medium · published August 9, 2026
What it is
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.
The record
Technical detail
- CVSS v3.1
- 4.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00142 · 3.2th percentile
- Weaknesses
- CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
- Published
- 2026-08-09T10:17Z
References (1)
EPSS history
Timeline