ProSolution WP Client gives Subscribers a flexible SSRF primitive
ProSolution WP Client before 2.0.9 exposes the proSol_url_validate AJAX action without a capability or nonce check. A Subscriber controls urlval, userval and passval; the plugin creates a WorkExpertAPI Authorization header and uses wp_remote_get() to request urlval plus the fixed /go/api/system/list/maritalstatus path. This can target loopback, private, link-local and cloud-metadata hosts. The inspected code fixes the method to GET and sends no body; the response and exfiltration behavior are not disclosed.
- Component
- ProSolution WP Client
- Plugin slug
prosolution-wp-client- Affected
- < 2.0.9
- Safe version
2.0.9- Published
- Aug 12, 2026
This CVE was published Aug 12, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
Update to 2.0.9 or later. Review outbound requests and low-privilege plugin traffic, and rotate credentials for internal services if sensitive endpoints may have been reached.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with an attacker-chosen method, headers and body.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N