The Solace Extra WordPress plugin suffers from an authorization bypass that allows unauthenticated users to permanently delete all content imported via the Starter Template feature, including posts, pages, media attachments, WooCommerce products, taxonomy terms, and sitebuilder templates. This flaw stems from insufficient verification of user permissions during the delete_previously_imported AJAX action. The consequence is the irreversible loss of site data created by legitimate users. The weakness is classified as CWE‑862.

Any WordPress installation running Solace Extra version 1.5.3 or earlier is affected. The vulnerability applies to all users, even those with Subscriber roles, because the AJAX action is exposed to unauthenticated requests.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests low exploitation probability at this time. While the vulnerability is not listed in CISA’s KEV catalog, its impact on data integrity is significant. Attackers can obtain the required nonce from any admin page (e.g., /wp-admin/profile.php) and trigger the deletion via the wp_ajax_nopriv_ route, which is reachable by users who are not logged in. This provides a straightforward path for complete data removal without requiring elevated privileges.