WORDPRESS · AUGUST 2026 · EARLY WARNING

Solace Extra WordPress Plugin Vulnerability: Critical CVE-2026-18316

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: CRITICAL
CVSS: 9.1
Affected component: solace extra plugin (wordpress)
Patched version: Not yet available

CVE-2026-18316

An early warning has been issued for a critical vulnerability in the Solace Extra plugin for WordPress. Users of affected versions should assess their exposure and take immediate action.

What happened

The Solace Extra plugin for WordPress is reportedly vulnerable to unauthorized modification and data loss due to a missing capability check on the import_zip() function. This vulnerability affects versions up to and including 1.6.0. Authenticated attackers with Subscriber-level access or higher can exploit this to wipe navigation menus, sidebar widgets, theme mods, and Elementor templates, and trigger arbitrary demo-content imports.

The vulnerability was first flagged on 2026-08-16T06:16:51.683000+00:00 and is currently under investigation. No exploitation in the wild has been confirmed at this time. Users are advised to review the primary sources for the most current information.

What to do about it

Upgrade the Solace Extra plugin to a version that fixes the vulnerability as soon as it is available.
Review your site content for any unauthorized changes.
Monitor the primary sources for updates on the vulnerability and any official fixes.
Consider implementing additional security measures to protect your WordPress site from potential attacks.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If solace extra plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using the Solace Extra plugin for WordPress version 1.6.0 or earlier, you are potentially affected.

What should I do right now?

Immediately upgrade the Solace Extra plugin to a version that fixes the vulnerability as soon as it is available and review your site content for any unauthorized changes.

Has an official fix been released?

No official fix has been published yet. Monitor the primary sources for updates.

Sources

[CVE-2026-18316] CVSS 9.1 CRITICAL

Join the 0Day waitlist →

← Back to all threats