The Solace Extra WordPress plugin allows an attacker with Subscriber-level access or higher to trigger the import_zip() function via the wp_ajax_action-import-zip AJAX handler. Because the function performs only a nonce check and lacks a capability check, an authenticated user can delete navigation menus, sidebar widgets, all theme modifications, and Elementor templates, as well as import arbitrary demo content. This is a classic case of missing authorization (CWE‑862) and can lead to significant loss of site data and the introduction of unintended content.

All WordPress sites that have the Solace Extra plugin installed, versions 1.6.0 and earlier. The vulnerability exists in the admin class and import files referenced in the plugin’s source (up to tag 1.6.0).

With a CVSS score of 9.1 the vulnerability is considered critical. The EPSS score is not available, but the lack of a capability check means any authenticated user, even a Subscriber, can exploit the flaw. The flaw is not listed in the CISA KEV catalog. An attacker does not need remote code execution; simply visiting the corresponding AJAX endpoint while logged in is sufficient to delete or import content. The exploit path is straightforward: gain any authenticated credential, request the AJAX URL with a valid nonce, and the plugin performs destructive actions without further verification.