solacewp vulnerabilities

Products

• Solace Extra 6
• Solace 1

Latest solacewp CVEs

Newest publication first

1. CVE-2026-18316 Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action

   Published 2026-08-16

   Critical·CVSS 9.1 EPSS 0.60%

   The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_ajax_action-import-zip and wp_ajax_nopriv...

2. CVE-2026-27535 WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability

   Published 2026-08-13

   High·CVSS 7.1 EPSS 0.32%

   Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

3. CVE-2026-13250 Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action

   Published 2026-07-11

   Medium·CVSS 5.3 EPSS 0.47%

   The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to perman...

4. CVE-2025-68911 WordPress Solace theme <= 2.1.16 - Broken Access Control vulnerability

   Published 2026-01-22

   Medium·CVSS 6.5 EPSS 0.35%

   Missing Authorization vulnerability in solacewp Solace solace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Solace: from n/a through <= 2.1.16.

5. CVE-2025-58203 WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability

   Published 2025-08-27

   Medium·CVSS 4.4 EPSS 0.16%

   Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.2.

6. CVE-2025-47464 WordPress Solace Extra plugin <= 1.3.1 - Server Side Request Forgery (SSRF) Vulnerability

   Published 2025-05-07

   Medium·CVSS 4.9 EPSS 0.23%

   Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.1.

7. CVE-2025-32652 WordPress Solace Extra plugin <= 1.3.1 - Arbitrary File Upload vulnerability

   Published 2025-04-17

   Critical·CVSS 9.9 EPSS 0.45%

   Unrestricted Upload of File with Dangerous Type vulnerability in solacewp Solace Extra solace-extra allows Using Malicious Files.This issue affects Solace Extra: from n/a through <= 1.3.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.