The Solace Extra WordPress plugin versions prior to 1.6.1 contain a missing authorization control in an AJAX action. Specifically, the plugin does not verify user capabilities or nonce tokens, which are security measures to ensure that only authorized users can perform sensitive actions. As a result, any authenticated user, including those with minimal privileges like subscribers, can manipulate post metadata arbitrarily and deactivate the active site templates. Additionally, the lack of nonce checks allows CSRF attacks from any logged-in user, potentially leading to unauthorized site modifications.

An attacker with any authenticated user account can exploit this vulnerability to modify post metadata on arbitrary posts and deactivate the site's active templates. This could disrupt site functionality and content integrity. The vulnerability also allows CSRF attacks, increasing the risk that an attacker could trick a logged-in user into performing these unauthorized actions. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting user roles that can authenticate or disable the vulnerable AJAX action if possible. Monitoring for unusual changes to post metadata and active templates may help detect exploitation attempts.