CVE-2026-13250 Overview
The Solace Extra plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 1.5.3. The plugin fails to verify user authorization before executing sensitive actions tied to the Starter Template feature. Unauthenticated attackers can permanently delete all content previously imported via the Starter Template feature, including posts, pages, media attachments, WooCommerce products, taxonomy terms, and sitebuilder templates. The flaw is categorized as Missing Authorization [CWE-862].
Critical Impact
Unauthenticated attackers can permanently destroy imported site content across affected WordPress installations, causing irreversible data loss for site owners relying on the Starter Template feature.
Affected Products
- Solace Extra plugin for WordPress — all versions through 1.5.3
- WordPress sites using the Starter Template import feature
- WooCommerce stores populated through Solace Extra imports
Discovery Timeline
- 2026-07-11 - CVE-2026-13250 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-13250
Vulnerability Analysis
The Solace Extra plugin exposes an AJAX handler responsible for resetting content imported via the Starter Template feature. The handler does not enforce capability checks or role validation before performing destructive database operations. As a result, any request carrying a valid nonce can trigger bulk deletion of imported posts, pages, media attachments, WooCommerce products, taxonomy terms, and sitebuilder templates.
The deletion is permanent and cannot be undone without restoring from backup. The vulnerability falls under Missing Authorization [CWE-862], where authentication or role verification is required but absent.
Root Cause
Two compounding defects create the bypass. First, the nonce required to authorize the request is emitted on every wp-admin page via wp_localize_script() hooked to admin_enqueue_scripts without any page guard. Any Subscriber-level user visiting /wp-admin/profile.php can read this nonce from the page source. Second, the handler is additionally registered via wp_ajax_nopriv_, exposing it to fully unauthenticated users. The plugin never calls current_user_can() to verify that the caller holds an administrative capability before executing the delete routines.
Attack Vector
The attack is network-reachable and requires no authentication. An attacker retrieves the nonce either by scraping an admin-facing endpoint accessible to low-privilege users or by leveraging the wp_ajax_nopriv_ registration. The attacker then issues an AJAX POST request to admin-ajax.php targeting the vulnerable action, which triggers the mass deletion routine against all content flagged as imported by the Starter Template. Refer to the Wordfence Vulnerability Report and the WordPress Solace Extra Code for the affected source paths.
Detection Methods for CVE-2026-13250
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php referencing Solace Extra reset or import actions from unauthenticated sessions.
- Sudden bulk removal of posts, pages, WooCommerce products, or media attachments previously created by the Starter Template importer.
- WordPress activity logs showing deletions with no associated administrator user ID.
- Empty taxonomy terms and missing sitebuilder templates immediately following an inbound AJAX request burst.
Detection Strategies
- Monitor web server access logs for POST requests to admin-ajax.php where the action parameter matches Solace Extra handlers and the session cookie is absent.
- Enable a WordPress activity or audit logging plugin to record mass deletions of posts and terms.
- Compare current post and product counts against periodic baselines to identify sudden drops.
Monitoring Recommendations
- Alert on any bulk delete events affecting more than a threshold number of posts or products in a short interval.
- Track outbound HTTP requests to admin-ajax.php originating from external IP addresses that did not first authenticate.
- Retain WordPress database backups with sufficient granularity to recover from destructive imports or deletions.
How to Mitigate CVE-2026-13250
Immediate Actions Required
- Update the Solace Extra plugin to a version later than 1.5.3 once released by the vendor.
- Deactivate and remove the plugin from any WordPress installation that does not actively require the Starter Template feature.
- Verify recent backups of the WordPress database and wp-content/uploads directory are intact and restorable.
- Review activity logs for signs of unauthorized deletions dating back to plugin installation.
Patch Information
Refer to the WordPress Solace Extra Changeset for the vendor code changes. Administrators should install the fixed release from the WordPress.org plugin directory as soon as it becomes available. The relevant source files are documented in the WordPress Solace Extra Import Update and the WordPress Solace Extra Class Update.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php from untrusted networks using web application firewall rules that block requests targeting Solace Extra actions.
- Temporarily deactivate the Solace Extra plugin until a patched release is installed.
- Remove or restrict Subscriber-level self-registration to reduce the pool of accounts able to retrieve the localized nonce.
- Enforce a WAF virtual patch that requires an authenticated administrator cookie for the vulnerable AJAX action.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
