ProSolution WP Client CVE-2026-19052

Exploitation requires an authenticated WordPress session at any role level, including subscriber - the minimum role typically granted upon user registration. The nonce that would normally validate AJAX requests is exposed in the public frontend, removing the usual CSRF barrier. Two specific conditions must both be present: (1) the ProSolution WP Client plugin version prior to 2.0.9 must be installed and active, and (2) the attacker must hold any valid WordPress user account on the target site. Exploitation is limited by the requirement for a valid authenticated session - unauthenticated visitors cannot trigger the actions even with the nonce, as WordPress still validates session cookies for wp_ajax_ (non-nopriv) endpoints. Sites with closed user registration or no low-privilege accounts are not practically exploitable.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects the limited scope: network-reachable, low complexity, low privilege, no confidentiality breach, and only a partial integrity impact. SSVC corroborates this - exploitation: none, automatable: no, technical impact: partial - indicating this is not a high-priority emergency for most organizations but should not be ignored. The public exploit availability via WPScan lowers the attacker skill threshold, and the nonce exposure means any subscriber-level account can reliably reproduce the attack. The absence of confidentiality impact (C:N) limits damage to data integrity (cleared logs, potentially forced sync side effects) rather than data theft. The non-automatable SSVC rating suggests exploitation requires a logged-in session per target site, making mass scanning campaigns impractical. Overall, this is a genuine but contained risk: the most likely abuse scenario is an insider or low-privileged user wiping audit trails to conceal other activity, which elevates its relevance in environments where the activity log serves a compliance or forensic function.

An attacker with a valid WordPress subscriber account - obtained through open registration, a compromised credential, or an insider threat - reads the nonce value exposed in the plugin's public frontend output, then crafts two authenticated AJAX POST requests to the WordPress admin-ajax.php endpoint targeting the unguarded administrative actions. In one sequence, the attacker forces a data synchronization (potentially causing data inconsistency or triggering unintended external API calls) and then clears the plugin's activity log to erase evidence of their actions. A public exploit demonstrating this technique is available via WPScan.