Executive brief
The Solace Extra WordPress plugin (used for building page layouts with Elementor) fails to verify user permissions when serving content via its AJAX interface. An attacker can retrieve the full text of unpublished draft, pending, private, or trashed page sections that would normally be hidden from public view, potentially exposing sensitive design, planning, or business content.
Technical details
The vulnerability is an authorization bypass in the plugin's get_elementor_content AJAX action (CWE-200: Exposure of Sensitive Information). The action does not validate user authentication or post publication status before returning Elementor-rendered HTML. An unauthenticated attacker can invoke the action via /wp-admin/admin-ajax.php?action=get_elementor_content&post_id=ID with only knowledge of the target post ID (easily enumerated), bypassing WordPress's native access controls which return HTTP 404 for the same content. The vulnerability requires Solace Extra ≤1.6.2, Elementor, and the existence of at least one Elementor-built non-public Site Builder part. Fixed in version 1.7.0.
Affected products
- Solace Extra WordPress plugin before 1.7.0
Timeline
- 2026-08-31: disclosed
- 2026-09-01: patched: Fixed in version 1.7.0