CVE-2026-16966: CWE-200 Information Exposure in Solace Extra

The Solace Extra WordPress plugin versions prior to 1.7.0 contain a vulnerability where an AJAX action does not enforce authorization or verify post status. This flaw permits unauthenticated visitors to read content from Site Builder parts that are not published, including drafts, pending, private, and trashed posts. This results in unintended information disclosure that bypasses WordPress's normal content access restrictions. The vulnerability is classified under CWE-200 (Information Exposure).

An attacker can access sensitive or unpublished content that should be restricted, potentially leading to leakage of confidential or private site information. There is no impact on integrity or availability, only confidentiality is affected. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoint if possible or disable the Solace Extra plugin. Monitor for vendor updates and apply any official patches promptly once released.