ProSolution WP Client CVE-2026-19049

No special conditions are required beyond the plugin being installed and active on the target WordPress site. The vulnerable cookie processing runs as a global WordPress hook on every HTTP request - no specific page, endpoint, login, or plugin feature needs to be accessed. The CVSS vector (PR:N/UI:N/AV:N/AC:L) confirms fully unauthenticated, remote, low-complexity exploitation against any WordPress site with this plugin active. What limits exploitation: the plugin must be installed and active (not merely present as an inactive plugin); the attack surface is bounded to sites using this specific niche client-management plugin; and the delete impact is limited to records within the plugin's own tables rather than arbitrary database writes.

The official CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects the network-accessible, zero-authentication, low-complexity nature of this flaw, with Scope:Changed indicating the SQL injection reaches data beyond the plugin's own authorization boundary. However, the official vector assigns I:N (no integrity impact), which conflicts with the description explicitly stating attackers can delete plugin-managed records - this is an integrity impact and the official vector appears to underrepresent the true risk; assessed vector below corrects this. EPSS at 0.21% (11th percentile) is low, suggesting limited observed real-world exploitation despite the severity and POC availability; this is consistent with a niche plugin affecting a smaller install base. A publicly available POC exists via WPScan, lowering the bar for exploitation significantly. No CISA KEV listing means active widespread exploitation is not confirmed. Combined signal: genuinely high technical risk for any site running this plugin, but real-world blast radius is constrained by the plugin's limited deployment footprint. Patch immediately for any affected installation.

A remote, unauthenticated attacker sends a standard HTTP GET request to any page on the target WordPress site, injecting a SQL payload as the value of the plugin's cookie. The plugin's global request hook processes the malicious cookie without any authentication check, executing the injected SQL against the WordPress database. The attacker iterates through time-based or UNION-based injection techniques to extract wp_users password hashes, secret keys from wp_options, or any other database table, and separately crafts delete payloads to purge plugin records. A publicly available POC via WPScan reduces the skill barrier for this attack.