CVE-2026-19050

Name of the Vulnerable Software and Affected Versions ProSolution WP Client versions prior to 2.0.9

Description An issue exists where the plugin fails to validate user-supplied URLs and does not verify the requester's capability or nonce before executing a server-side HTTP request. This allows any authenticated user, including those with subscriber-level privileges, to perform Server-Side Request Forgery (SSRF)—a technique where the server is coerced into making requests to internal hosts and services. The attacker can specify the HTTP method, headers, and body for these requests via the proSol url validate() function.

Recommendations Update ProSolution WP Client to version 2.0.9 or later.