ProLancer Element CVE-2026-32471

Exploitation requires a valid WordPress subscriber-level (or higher) account on the target installation, as confirmed by the CVSS PR:L metric. Sites with open subscriber registration (the WordPress default for community or membership sites) are directly exploitable by any anonymous internet user who self-registers. Sites where registration is disabled or restricted to invitation-only are not remotely exploitable without prior credential compromise. The ProLancer Element plugin must be installed and active. No special plugin configuration or non-default feature enablement is indicated as a prerequisite. The scope change (S:C) implies the injection can reach WordPress database tables beyond the plugin's own, but does not require any additional configuration. Exploitation is limited to authenticated sessions - unauthenticated exploitation is not supported by the PR:L CVSS metric.

The CVSS 8.5 score is supported by several compounding factors: network reachability (AV:N), low complexity (AC:L), no user interaction (UI:N), and a scope change (S:C) with high confidentiality impact (C:H). The only barrier is a subscriber-level account (PR:L). EPSS score is not provided in the available data, so exploitation probability cannot be quantified. KEV status is absent, meaning active exploitation is not confirmed by CISA. No POC is referenced in the Patchstack advisory or EUVD record. Despite the high CVSS, real-world risk is modulated by the requirement for a valid WordPress account - sites that restrict or disable subscriber registration significantly reduce their attack surface. Sites with open registration (blogs, communities, membership sites) face materially higher risk. The A:L (low availability impact) component is notable and may reflect the ability to execute heavy or locking queries, though this is not elaborated in the advisory.

An attacker registers a free subscriber account on a WordPress site running ProLancer Element ≤1.4.8, then submits a crafted HTTP request to the plugin's vulnerable endpoint with a SQL payload embedded in a parameter. The unsanitized input is passed directly to a WordPress database query, allowing the attacker to extract sensitive database contents - including WordPress user hashes, email addresses, and potentially configuration secrets - without any administrator interaction or elevated privileges.