ProSolution WP Client CVE-2026-19050

Exploitation requires a valid WordPress user account at subscriber level or above - the lowest authenticated role, often freely obtainable via open registration. No special plugin configuration, non-default settings, or elevated WordPress role is required; the vulnerability is present in the plugin's default installed state due to the complete absence of capability and nonce checks on the affected function. The attack is limited by: (1) the need for at least one authenticated session - unauthenticated users cannot exploit this; (2) the server's network reachability to the targeted internal host - services not reachable from the server's network position cannot be probed; and (3) blind versus reflected SSRF behavior depends on whether the plugin returns response data to the caller, which is not fully specified in available sources. Sites with user registration disabled and no active subscriber accounts have materially reduced exposure.

The CVSS 6.4 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N accurately captures the risk profile: network-reachable, low-complexity exploitation, but gated by a requirement for at least subscriber-level authentication. SSVC rates Exploitation as 'none' - likely reflecting no confirmed in-the-wild cases - yet this conflicts with the confirmed publicly available exploit code, meaning practical exploitation difficulty is lower than SSVC suggests; the 'Automatable: no' rating aligns with the authentication prerequisite. EPSS data is absent from the input, limiting probabilistic forecasting. The S:C scope change is the most consequential signal: successful exploitation enables pivoting to internal services (metadata APIs, internal admin panels, monitoring endpoints) that the attacker cannot reach directly. Even a mid-sized municipal IT team in mielec running a membership-based WordPress portal should treat this as a near-term patch priority given that subscriber accounts are often freely self-registered. No CISA KEV listing means active exploitation is not confirmed, but the combination of a low-barrier authentication requirement and public exploit code makes this a realistic near-term threat for any site with open registration.

An attacker registers a free subscriber account on a WordPress site running ProSolution WP Client before 2.0.9, then sends a crafted authenticated POST request to the vulnerable plugin endpoint, specifying an internal IP address (such as http://169.254.169.254/latest/meta-data/ for cloud metadata or http://127.0.0.1:8080/admin for a local admin panel) as the target URL along with attacker-chosen headers and a request body. The server executes the request on the attacker's behalf and may return the internal service response. With publicly available exploit code documented by WPScan, this attack requires minimal technical skill beyond obtaining a subscriber account.