What is the CVSS score of CVE-2026-19049?

CVE-2026-19049 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of ProSolution WP Client are affected by CVE-2026-19049?

Organizations using ProSolution WP Client WordPress plugin versions prior to 2.0.9 face immediate risk of database compromise and sensitive data theft.. A patch is available.

Is there a public PoC exploit available for CVE-2026-19049?

Yes, a public proof-of-concept exploit is available for CVE-2026-19049. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-19049?

Within 24 hours, conduct a complete inventory of WordPress installations using ProSolution WP Client versions prior to 2.0.9 and flag for emergency remediation. Within 7 days, deploy vendor-released patch version 2.0.9 or later to all affected instances, prioritizing production environments. Within 30 days, verify successful patch deployment across the entire WordPress infrastructure, review database access logs for exploitation indicators, and document remediation completion for compliance records.

ProSolution WP Client CVE-2026-19049

EUVD-2026-55010 HIGH

SQL Injection (CWE-89)

2026-08-10 WPScan

GHSA-6f76-8449-qr42

SQLi WordPress Prosolution Wp Client

8.6

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

9.3 CRITICAL

Agrees with official vector except I:L added to reflect confirmed delete capability on plugin records, omitted from official I:N scoring.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:32 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

8.6 (HIGH)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

HIGH 8.6

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.

AnalysisAI

Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrary WordPress database contents to any remote attacker and permits deletion of plugin-managed records without any login or capability check. The plugin blindly embeds an unsanitized cookie value into SQL queries and executes this logic on every HTTP request site-wide, meaning any page load against a vulnerable site is a valid attack surface. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send HTTP request with SQL-injected cookie value

Delivery

Plugin global hook processes cookie without sanitization on every request

Exploit

Malicious SQL executes against WordPress database

Execution

Exfiltrate arbitrary database records including credentials

Impact

Optionally issue DELETE payloads to purge plugin-managed records

Access

Send HTTP request with SQL-injected cookie value

Delivery

Plugin global hook processes cookie without sanitization on every request

Exploit

Malicious SQL executes against WordPress database

Execution

Exfiltrate arbitrary database records including credentials

Impact

Optionally issue DELETE payloads to purge plugin-managed records

Vulnerability AssessmentAI

Exploitation	No special conditions are required beyond the plugin being installed and active on the target WordPress site. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The official CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects the network-accessible, zero-authentication, low-complexity nature of this flaw, with Scope:Changed indicating the SQL injection reaches data beyond the plugin's own authorization boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A remote, unauthenticated attacker sends a standard HTTP GET request to any page on the target WordPress site, injecting a SQL payload as the value of the plugin's cookie. The plugin's global request hook processes the malicious cookie without any authentication check, executing the injected SQL against the WordPress database. …
Remediation	Update the ProSolution WP Client plugin to version 2.0.9 or later immediately; this is the vendor-released patch that addresses the SQL injection by sanitizing the cookie value before use in database queries. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a complete inventory of WordPress installations using ProSolution WP Client versions prior to 2.0.9 and flag for emergency remediation. …

Threat intelligence, references, and detailed analysis are available after sign-in.