Server-side Request Forgery in ProSolution WP Client Plugin
CVE-2026-19050
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19050?
The ProSolution WP Client WordPress plugin prior to version 2.0.9 has a critical security flaw that permits authenticated users to leverage an unvalidated URL input for server-side HTTP requests. Due to the lack of validation on the user-supplied URL and insufficient checks on user capabilities or nonces, an attacker could exploit this weakness to execute requests to internal services and hosts. This could potentially lead to unauthorized access or data exposure within the site's network.
Affected Version(s)
ProSolution WP Client 0 < 2.0.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.