CVE-2026-19050: ProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validate
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with an attacker-chosen method, headers and body.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19050?
CVE-2026-19050 has a risk rating of 55, indicating a moderate level of severity.
How do I fix CVE-2026-19050?
To fix CVE-2026-19050, update the ProSolution WP Client plugin to version 2.0.9 or later.
What type of vulnerability is CVE-2026-19050?
CVE-2026-19050 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Who is affected by CVE-2026-19050?
Any authenticated user, including subscribers, can exploit CVE-2026-19050 due to inadequate URL validation.
What is the impact of CVE-2026-19050?
The impact of CVE-2026-19050 allows authenticated users to make arbitrary server-side HTTP requests, potentially leading to data exposure.