CVE-2026-19052

Name of the Vulnerable Software and Affected Versions ProSolution WP Client versions prior to 2.0.9

Description Insufficient capability checks on two administrative AJAX actions allow any authenticated user, including those with subscriber privileges, to perform unauthorized actions. Because the nonce (a unique token used to prevent cross-site request forgery) is exposed on the public frontend, an attacker can trigger administrative data synchronization and clear activity records via the proSol ajaxTablesync and proSol ajaxClearlog calls.

Recommendations Update ProSolution WP Client to version 2.0.9 or later.