Executive brief
The Solace Extra WordPress plugin fails to verify user permissions before allowing AJAX requests that modify critical site settings. Low-privilege users (Subscriber role) can read an exposed security token on admin pages and use it to change site logos, theme settings, delete widgets, and remove imported templates—defacing the site or causing data loss without needing administrator credentials.
Technical details
The plugin exposes a global AJAX nonce (security token) in the `ajax_object` JavaScript variable on all admin pages reachable by low-privilege users, including profile.php. Multiple AJAX actions (`update_logo2`, theme switching, widget deletion, template removal) validate the nonce but perform no capability checks via `current_user_can()`, allowing Subscriber-role users to modify site-wide settings they should not access. An attacker with any registered account can extract the publicly-exposed nonce and submit arbitrary AJAX requests to modify theme mods, delete content, or deface the site. The vulnerability is confirmed fixed in version 1.6.1.
Affected products
- Solace Extra before 1.6.1
Timeline
- 2026-08-03: disclosed
- 2026-08-08: advisory
- 2026-08-08: patched: Fixed in Solace Extra 1.6.1