A security flaw (tracked as CVE-2026-18316) affects the Solace Extra plugin for WordPress, with all versions up to and including 1.6.0 impacted. The gap lets any person logged into your WordPress site, even users with only basic subscriber access, make unauthorized changes to or delete important site content.
Attackers with this level of access can wipe your site's navigation menus, delete sidebar widgets, erase all custom theme settings, remove Elementor page templates, and run unapproved demo content imports that can break your site's look and core features.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-18316
