Is CVE-2026-19052 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19052 being exploited in the wild.

How severe is CVE-2026-19052?

Medium severity, with a CVSS score of 4.3, published 12 August 2026.

Which products and versions are affected?

ProSolution WP Client before 2.0.9.

Is there a fix for CVE-2026-19052?

A patch was published on 2026-08-10: Fixed in version 2.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19052 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-19052?

Check whether you run ProSolution WP Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19052: ProSolution WP Client privilege escalation in AJAX actions

CVE-2026-19052 · Severity: medium · CVSS 4.3 · Published 2026-08-12

The ProSolution WP Client WordPress plugin is used to manage job listings and candidate data integration with external systems. Versions before 2.0.9 fail to verify user permissions on two administrative AJAX actions, allowing any logged-in user (even with minimal privileges like a Subscriber) to clear activity logs and force data re-synchronization—actions normally restricted to administrators. This enables unauthorized tampering with plugin records and potential data disruption.

Technologies: ProSolution WP Client. Vendors: ProSolution.

Quick answers

Is CVE-2026-19052 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19052 being exploited in the wild.
How severe is CVE-2026-19052?: Medium severity, with a CVSS score of 4.3, published 12 August 2026.
Which products and versions are affected?: ProSolution WP Client before 2.0.9.
Is there a fix for CVE-2026-19052?: A patch was published on 2026-08-10: Fixed in version 2.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19052 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-19052?: Check whether you run ProSolution WP Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing capability check (CWE-862) on two AJAX handlers: proSol_ajaxClearlog and proSol_ajaxTablesync. The nonce required to invoke these actions is publicly exposed in the frontend job-portal page source code, making it accessible to any authenticated user. An attacker with a subscriber account can extract the nonce from the public page, then POST requests to wp-admin/admin-ajax.php to trigger administrative operations: clearing the activity log and truncating/re-syncing plugin data tables. No additional CSRF protection is enforced beyond the weak public nonce. The fix was released in version 2.0.9.

Affected products

ProSolution ProSolution WP Client before 2.0.9

Timeline

2026-08-10: disclosed
2026-08-10: patched: Fixed in version 2.0.9

References

https://wpscan.com/vulnerability/39bf1b67-34f1-456a-b420-7bbf238964a1/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.