Description

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with an attacker-chosen method, headers and body.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-12T06:20:55.603Z",
  "pubdate": "2026-08-12T06:20:55.603Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the ProSolution WP Client WordPress plugin affecting versions prior to 2.0.9. The security flaw stems from an absolute lack of validation mechanisms for user-supplied URLs combined with the complete absence of capability checks and cryptographic nonce validation prior to executing outbound server-side HTTP requests.\nThe impact of this vulnerability is severe, enabling authenticated low-privileged users, specifically subscribers, to leverage the hosting server as a proxy to issue arbitrary HTTP requests targeting internal infrastructure, loopback addresses, and restricted local services that are normally shielded from external network perimeters.\nAn attacker capable of authenticating as a basic subscriber can exploit this vulnerability to specify arbitrary request methods, custom headers, and malicious payloads within the body of the forged request. This allows for internal reconnaissance, interaction with local administrative interfaces, and potential exploitation of internal network services.\nThe risk implication is elevated due to the ability to bypass network segmentation and firewall boundaries by utilizing the trusted WordPress server execution context. Mitigation requires updating the ProSolution WP Client WordPress plugin to version 2.0.9 or higher to ensure proper input sanitization, URL validation, and strict authorization enforcement.",
  "technicalDetails": "The vulnerability resides within the ProSolution WP Client WordPress plugin handling of server-side HTTP requests in versions prior to 2.0.9. The root cause of the security flaw is twofold: an absence of rigorous input validation and sanitization regarding user-supplied URLs, and a complete failure to enforce access control checks such as user capabilities or cryptographic nonces on the vulnerable endpoint.\nAuthentication and privilege requirements are minimal, as any user authenticated with low-level privileges, such as a standard subscriber account, can interact with the vulnerable functionality. Network exposure is constrained only to authenticated users of the WordPress instance, but the resulting attack surface extends internally to the private network hosting the web application.\nThe exploitation flow proceeds step-by-step as follows. First, the authenticated attacker crafts an HTTP request directed at the vulnerable endpoint within the ProSolution WP Client plugin. Within this request, the attacker supplies a malicious or internal target URL via a parameter, along with attacker-chosen HTTP methods, custom headers, and a customized request body. Second, the plugin processes the input without verifying whether the requesting user possesses the administrative capabilities required to initiate outbound server requests, nor does it validate a security nonce to prevent cross-site request forgery or unauthorized invocations.\nThird, the application fails to perform URL validation or schema restriction, allowing the entry of internal IPs, loopback addresses (e.g., 127.0.0.1 or localhost), or metadata service endpoints. Fourth, the server executes the outbound HTTP request using the supplied parameters on behalf of the application, effectively bypassing network access controls and perimeter firewalls.\nPost-exploitation impact includes the ability to scan internal network ports, interact with unprotected internal web applications, retrieve sensitive data from local services, and potentially leverage the SSRF vector to exploit remote code execution or information disclosure vulnerabilities in internal network hosts that trust the WordPress server."
}