→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-19050 · prosolution-wp-client

جعل درخواست سمت سرور (SSRF) در افزونه ProSolution WP Client

The ProSolution WP Client plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 2.0.8. This is due to a missing capability check on the proSol_url_validate() AJAX handler allowing any authenticated user to trigger outbound requests to arbitrary URLs, combined with a lack of SSRF validation on the urlval parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application, including internal network resources and cloud metadata endpoints.