The Solace Extra WordPress plugin before version 1.7.2 does not perform any authorization or post‑status checks on its front‑end preview routes, allowing unauthenticated visitors to read the rendered content of posts or pages that are normally unpublished. This flaw is a CWE‑200 Information Exposure due to missing validation of post status.

WordPress sites that have the Solace Extra plugin installed with a version older than 1.7.2. Any site running an earlier release is affected; newer releases (1.7.2 and above) are considered unfazed.

The vulnerability is accessed via a publicly reachable preview URL on the WordPress front end, with no authentication required. It is scored with a CVSS score of 5.3, an EPSS score of less than 1 %, and is not listed in CISA’s KEV catalog. The disclosure of confidential or sensitive content represents a moderate confidentiality risk, particularly for sites that keep private drafts or drafts containing business data.