CVE-2026-19050
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL or check the requester's capability or nonce before making a server-side HTTP request. This allows any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with attacker-chosen method, headers, and body.
Risk Assessment
An attacker can use the server to scan internal networks, access internal services, or perform SSRF attacks, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update the ProSolution WP Client plugin to version 2.0.9 or later. Additionally, restrict access to privileged functions and implement URL validation.
Original NVD description (English source)
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with an attacker-chosen method, headers and body.