EUVD-2026-57106
GHSA-98wq-55q3-fr94
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable via AJAX, low complexity due to exposed nonce; PR:L because any authenticated session suffices; integrity-only impact from log wipe and sync trigger.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.
AnalysisAI
Missing authorization on two administrative AJAX endpoints in ProSolution WP Client WordPress plugin before 2.0.9 allows any low-privileged authenticated user - including subscribers - to trigger administrative data synchronization and erase the plugin's activity log. The security nonce protecting these endpoints is exposed in the public-facing frontend, effectively nullifying WordPress's built-in CSRF protection and reducing the attack bar to any account with login access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session at any role level, including subscriber - the minimum role typically granted upon user registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects the limited scope: network-reachable, low complexity, low privilege, no confidentiality breach, and only a partial integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid WordPress subscriber account - obtained through open registration, a compromised credential, or an insider threat - reads the nonce value exposed in the plugin's public frontend output, then crafts two authenticated AJAX POST requests to the WordPress admin-ajax.php endpoint targeting the unguarded administrative actions. In one sequence, the attacker forces a data synchronization (potentially causing data inconsistency or triggering unintended external API calls) and then clears the plugin's activity log to erase evidence of their actions. … |
| Remediation | Update ProSolution WP Client to version 2.0.9 or later, which is confirmed as the vendor-patched release per the WPScan advisory at https://wpscan.com/vulnerability/39bf1b67-34f1-456a-b420-7bbf238964a1/ and EUVD-2026-57106. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prosolution Wp Client
View allSQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.6) lets remote attackers inject SQL
Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrar
Server-side request forgery in ProSolution WP Client WordPress plugin (all versions before 2.0.9) allows any authenticat
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugi
Unauthenticated remote code execution in the ProSolution WP Client WordPress plugin (versions ≤ 2.0.0) allows attackers
Unauthenticated arbitrary file upload in ProSolution WP Client plugin (≤1.9.9) enables attackers to upload executable fi
Arbitrary file deletion in the ProSolution WP Client WordPress plugin (all versions through 2.0.8) lets unauthenticated
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today