ProLancer Element CVE-2026-28190

Exploitation requires an authenticated WordPress account with at minimum subscriber-level privileges. On sites with open user registration, any internet user can self-register to obtain this role, effectively reducing the attack surface to near-unauthenticated. The ProLancer Element plugin must be installed and active on the target WordPress site. No non-default configuration or specific feature enablement is documented as a prerequisite beyond the plugin being present. Exploitation is bounded to integrity and availability impact - data exfiltration is not achievable via this vulnerability alone. Sites without open registration require the attacker to possess or otherwise obtain a valid subscriber-or-higher account, which meaningfully limits exposure.

The CVSS 7.1 (High) score reflects network exposure (AV:N), low attack complexity (AC:L), low required privileges (PR:L - subscriber level), no user interaction (UI:N), high integrity impact (I:H), and low availability impact (A:L). The subscriber privilege requirement is the primary limiting factor, but on WordPress sites with open user registration this is trivially satisfied by any internet user who self-registers, effectively reducing the practical attack bar to near-unauthenticated. Sites with closed or invitation-only registration substantially reduce real-world exposure. No EPSS probability score was included in the source data, and the CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis; no public exploit code has been identified. The absence of confidentiality impact (C:N) means data exfiltration is not achievable via this vector alone, concentrating risk on content integrity and limited service disruption. Overall, real-world risk is moderate to high for WordPress deployments with open subscriber registration, and low for closed-membership installations.

An attacker self-registers as a subscriber on a WordPress site running ProLancer Element 1.4.8 or earlier, then sends a crafted HTTP request to a plugin endpoint that lacks proper authorization checks, bypassing role-based restrictions to perform privileged actions - such as modifying or deleting plugin-managed content - that should be restricted to editors or administrators. No public exploit code has been identified at time of analysis, though the low complexity and clear vulnerability class make independent exploitation straightforward.