A missing capability check in the Solace Extra plugin's import_zip() function allows attackers to destroy menus, widgets, theme mods, and Elementor templates on affected sites.
What Is It
CVE-2026-18316 is a missing authorization flaw (CWE-862) in the Solace Extra plugin for WordPress. The import_zip() handler is registered on both the wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip hooks and performs no capability check; it only verifies the ajax-nonce nonce. That nonce is emitted on every admin page via wp_localize_script on an unrestricted admin_enqueue_scripts hook, making it obtainable by any authenticated user, including Subscribers.
The issue carries a CVSS 3.1 base score of 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, network-reachable, low complexity, no user interaction, with high integrity and availability impact. The PR:N (no privileges required) component reflects the handler's registration on the nopriv AJAX hook, which exposes the endpoint to unauthenticated requests; the only barrier is possession of a valid ajax-nonce value. Because that nonce is rendered on every admin page for every logged-in role, the practical bar for reliable exploitation is a Subscriber-level account rather than full anonymity.
Why It Matters
An attacker holding only Subscriber-level access, the default role on any site with open registration, comments, or membership features, can trigger the import routine and cause irreversible data loss. The reported impact includes wiping navigation menus, clearing sidebar widgets via update_option('sidebars_widgets', array()), removing all theme mods via remove_theme_mods(), and destroying Elementor templates. The same handler can also be abused to trigger arbitrary demo-content imports, overwriting live site content.
There is no confidentiality impact, but the integrity and availability consequences are severe and immediate. Sites permitting self-service registration should assume the precondition is trivially met.
What's Vulnerable
- Vendor: solacewp
- Product: Solace Extra (WordPress plugin)
- Affected versions: all versions up to and including 1.6.0
Patch Status
The NVD record (published 2026-08-16, status Received) does not name a fixed version. A plugin repository changeset is referenced among the advisory sources and appears to correspond to the code change. Administrators should treat any installation at or below 1.6.0 as exposed and update to the latest available release, or deactivate and remove the plugin until a confirmed fixed version is verified. Restricting or disabling new user registration is a useful interim control, but it does not remove the underlying missing authorization check.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; no active exploitation has been confirmed, and no KEV remediation deadline applies.