EUVD-2026-57105
GHSA-cjm3-jv49-2qgp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network-reachable SSRF requiring only subscriber authentication (PR:L); scope changes to internal services (S:C); partial confidentiality and integrity impact via arbitrary internal requests; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with an attacker-chosen method, headers and body.
AnalysisAI
Server-side request forgery in ProSolution WP Client WordPress plugin (all versions before 2.0.9) allows any authenticated user - including low-privileged subscribers - to force the hosting server to issue arbitrary HTTP requests to internal hosts and services, with full attacker control over request method, headers, and body. The vulnerability bypasses both WordPress capability checks and nonce verification entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress user account at subscriber level or above - the lowest authenticated role, often freely obtainable via open registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N accurately captures the risk profile: network-reachable, low-complexity exploitation, but gated by a requirement for at least subscriber-level authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a WordPress site running ProSolution WP Client before 2.0.9, then sends a crafted authenticated POST request to the vulnerable plugin endpoint, specifying an internal IP address (such as http://169.254.169.254/latest/meta-data/ for cloud metadata or http://127.0.0.1:8080/admin for a local admin panel) as the target URL along with attacker-chosen headers and a request body. The server executes the request on the attacker's behalf and may return the internal service response. … |
| Remediation | The primary fix is to upgrade ProSolution WP Client to version 2.0.9 or later, which is confirmed available from the vendor per patch data and documented in the WPScan advisory at https://wpscan.com/vulnerability/76d9ef00-5335-4373-903c-4ff368417f94/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prosolution Wp Client
View allSQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.6) lets remote attackers inject SQL
Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrar
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugi
Unauthenticated remote code execution in the ProSolution WP Client WordPress plugin (versions ≤ 2.0.0) allows attackers
Unauthenticated arbitrary file upload in ProSolution WP Client plugin (≤1.9.9) enables attackers to upload executable fi
Arbitrary file deletion in the ProSolution WP Client WordPress plugin (all versions through 2.0.8) lets unauthenticated
Missing authorization on two administrative AJAX endpoints in ProSolution WP Client WordPress plugin before 2.0.9 allows
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today