CVE-2026-16948

The CVE concerns the Solace Extra WordPress plugin prior to version 1.6.1. The issue stems from missing capability checks in several AJAX actions and exposure of the nonce protecting them on admin pages, which low-privilege users (down to the Subscriber role) can access. This allows modification ...