CVE-2026-16948

HighCVSS 8.1/10Last modified Aug 26, 2026

Description

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Unknown	Solace Extra	< 1.6.1

References

https://wpscan.com/vulnerability/50e47ee9-cffc-4435-bc77-77fc65e9ff16/

Timeline

Published: Aug 8, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-169495.8The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing CVE-2026-16956.1An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0 CVE-2026-169508.6The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, a CVE-2026-169516.7IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local authenticated attacker to execute arbitrary code due to a heap-based buffe CVE-2026-169525.5IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to uncontrolled resource consump CVE-2026-169534.8The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the CVE-2026-169546.5The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline scri CVE-2026-169555.0The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to a CVE-2026-169569.8IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special CVE-2026-169572.7The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying o CVE-2026-169587.5IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.CVE-2026-169596.8The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in on