ProSolution WP Client CVE-2026-19053

Requires that the ProSolution WP Client plugin (version below 2.0.6) be installed and active on a reachable WordPress site; the vulnerable parameter is in a code path exposed to unauthenticated visitors (PR:N, UI:N), so no login, user interaction, or non-default configuration is needed beyond having the plugin enabled. The primary limiting factor is prevalence - the plugin is niche and not widely deployed - rather than any technical precondition; exploitation is blind, so an attacker must use inference-based extraction rather than reading results directly from responses.

The signals are mixed. CVSS 9.1 with vector AV:N/AC:L/PR:N/UI:N reflects a genuinely low-barrier, remote, unauthenticated, low-complexity flaw with high confidentiality and integrity impact, and public exploit code lowers the skill barrier further. Countering this, the EPSS score is only 0.16% (6th percentile), the vulnerability is NOT in CISA KEV (no confirmed active exploitation), and the affected plugin appears to be a niche product with limited deployment - which likely explains the low EPSS despite the high CVSS. There is no SSVC decision data provided. Net assessment: technically severe and easy to exploit where the plugin is installed, but real-world mass-exploitation risk is currently moderated by low prevalence and no evidence of active exploitation. Organizations running this specific plugin should treat it as high priority; the broader population faces limited exposure. Note the provided CVSS lists I:H for a blind SQLi, which typically favors data disclosure over modification - integrity impact should be verified against the actual injectable query.

An unauthenticated attacker sends a crafted HTTP request to the WordPress site with a malicious SQL payload in the vulnerable plugin parameter, using boolean- or time-based blind techniques to infer query results. Over successive requests they enumerate the wp_users table and exfiltrate password hashes and secret keys. Public exploit code exists, and the low attack complexity (AC:L) with no authentication (PR:N) makes this automatable at scale against exposed installs.