CVE-2026-19052

Deferred Deferred - Pending Action

Privilege Escalation in ProSolution WP Client Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-19052

EUVD

EUVD-2026-57106

Affected Vendors & Products

Vendor	Product	Version / Range
prosolution	wp_client	to 2.0.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-19052 affects the ProSolution WP Client WordPress plugin before version 2.0.9. It involves two administrative AJAX actions, proSol_ajaxTablesync and proSol_ajaxClearlog, that lack proper capability checks. The nonce required for these actions is exposed on the plugin's public frontend, allowing any authenticated user, including subscribers, to trigger unauthorized administrative functions like data synchronization and clearing plugin activity logs.

Detection Guidance

Check the installed version of the ProSolution WP Client plugin. If it is below 2.0.9, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in WP-CLI to verify the version.

Impact Analysis

An attacker with even basic access (like a subscriber account) could misuse this flaw to synchronize or clear sensitive plugin data without proper authorization. This could lead to data loss, unauthorized modifications, or exposure of confidential information stored by the plugin.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the ProSolution WP Client plugin to version 2.0.9 or later immediately. Remove or restrict access for unauthorized users like subscribers until the update is applied.

Hi! I’m here to help you understand CVE-2026-19052. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70