CVE-2026-19052Disclosure

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/39bf1b67-34f1-456a-b420-7bbf238964a1/

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-19052

Full discourse1 post

CVE@CVEnew46d
Disclosure
CVE-2026-19052 The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published… https://www.cve.org/CVERecord?id=CVE-2026-19052
Post summary
The CVE reveals that ProSolution WP Client WordPress plugin prior to 1.0.9 lacks capability checks on two administrative AJAX actions with the nonce published, indicating the potential for privilege escalation. No PoC, exploit code, or patch details are provided.
000001.5K
57.9K followersView on X

Explore more

Back to dashboard