CVE-2026-18316 is a missing authorization vulnerability (CWE-862) in the Solace Extra WordPress plugin's import_zip() function. The AJAX handlers wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip verify only an 'ajax-nonce' nonce that is exposed to all authenticated users via an unrestricted admin_enqueue_scripts hook. This lack of capability checks enables attackers with Subscriber-level privileges or higher to execute unauthorized modifications including wiping navigation menus, sidebar widgets, theme modifications, Elementor templates, and initiating arbitrary demo-content imports. The vulnerability affects all versions up to and including 1.6.0. No patch or official remediation has been disclosed as of the publication date.

An attacker with minimal authenticated access (Subscriber-level or above) can exploit this vulnerability to cause significant data loss and unauthorized modifications to site navigation, widgets, theme settings, and Elementor templates. This can disrupt website functionality and content integrity, potentially requiring extensive recovery efforts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to the import_zip() function. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor updates closely for an official fix.