CVE-2026-19049: ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie
The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ProSolution WP Client WordPress pluginto a version that resolves this vulnerability.Fixed in 2.0.9 - Configuration
Update the ProSolution WP Client WordPress plugin so that the 'removesite' cookie value is sanitised before being used in SQL queries and the request processing includes authentication/capability checks to prevent unauthenticated SQL injection and record deletion.
ProSolution WP Client WordPress plugin Cookie value handling (e.g., 'removesite' cookie processing) = Sanitize cookie value before using it in SQL queries and process it only with proper authentication/capability checks
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19049?
CVE-2026-19049 has a risk rating of 80, indicating a high severity level.
How do I fix CVE-2026-19049?
To fix CVE-2026-19049, update the ProSolution WP Client plugin to version 2.0.9 or later.
What type of vulnerability is CVE-2026-19049?
CVE-2026-19049 is an SQL Injection vulnerability that allows remote code execution and data deletion.
Who is affected by CVE-2026-19049?
Users of the ProSolution WP Client WordPress plugin versions prior to 2.0.9 are affected by CVE-2026-19049.
What impact does CVE-2026-19049 have on my website?
CVE-2026-19049 could allow unauthorized users to read sensitive database information and delete data, compromising website integrity.