CVE-2026-19049
Deferred Deferred - Pending Action

SQL Injection in ProSolution WP Client WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-26

Assigner: WPScan

Description
The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-26
Generated
2026-08-30
AI Q&A
2026-08-10
EPSS Evaluated
2026-08-29
NVD
CVE-2026-19049
EUVD
EUVD-2026-55010

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
prosolution wp_client to 2.0.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated SQL injection in the ProSolution WP Client WordPress plugin before version 2.0.9. It occurs because the plugin does not properly sanitize a cookie value used in SQL queries. The flaw allows unauthenticated users to read arbitrary data from the database and delete records stored by the plugin. The issue arises as the plugin processes the malicious cookie on every request without requiring authentication or capability checks.

Detection Guidance

Check if the ProSolution WP Client plugin version is below 2.0.9 by inspecting the WordPress admin panel or using WP-CLI with the command: wp plugin list | grep prosolution-wp-client. Monitor database queries for suspicious activity or errors related to SQL operations.

Impact Analysis

This vulnerability can allow attackers to access sensitive data stored in your WordPress database, such as user information, posts, or plugin-specific records. Attackers could also delete critical data managed by the ProSolution WP Client plugin, potentially disrupting your website's functionality or causing data loss. Since no authentication is required, any unauthenticated user could exploit this issue.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access or deletion of personal or protected health information. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A breach could lead to legal penalties, fines, or reputational damage due to failure to meet regulatory requirements.

Mitigation Strategies

Update the ProSolution WP Client plugin to version 2.0.9 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied to prevent unauthenticated SQL injection and data deletion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19049. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart