Vulnerability details
CVE-2026-19049
ProSolution WP Client
ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie
CVSS 3.1
8.6High
Official description
The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| — | ProSolution WP Client | v < 2.0.9 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://wpscan.com/vulnerability/5405c86c-1cf5-4123-9dea-864096d07520/ exploitvdb-entrytechnical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-10
- Last updated
- 2026-08-12
- State
- Published
- Assigner (CNA)
- WPScan
Exploit prediction (EPSS)
0.51%
Probability of exploitation in 30 days
44.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')