Description

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T06:21:05.213Z",
  "pubdate": "2026-08-12T06:21:05.213Z",
  "executiveSummary": "An access control vulnerability exists in the ProSolution WP Client WordPress plugin prior to version 2.0.9, specifically concerning insufficient authorization checks on administrative AJAX actions. The vulnerability enables authenticated low-privileged users, such as subscribers, to invoke administrative functions including data synchronization and the clearing of system activity records. The root cause stems from the complete absence of capability checks combined with the exposure of sensitive cryptographic nonces on the public-facing frontend of the website. Consequently, any authenticated user can harvest the publicly accessible nonce and issue forged AJAX requests to execute privileged backend operations. The risk implication involves unauthorized state modification and potential data manipulation within the administrative scope of the affected WordPress installation. Exploitation requires authenticated access to the target system, such as a basic subscriber account, alongside the ability to retrieve the published nonce from the frontend source code or DOM. Remediation requires updating the ProSolution WP Client WordPress plugin to version 2.0.9 or later, where proper capability checks and secure nonce handling are implemented.",
  "technicalDetails": "The ProSolution WP Client WordPress plugin prior to version 2.0.9 suffers from a broken access control vulnerability localized within its backend AJAX action handlers. The vulnerable component consists of two distinct administrative AJAX endpoints designed to perform sensitive operations: triggering administrative data synchronisation and clearing plugin activity records. The primary root cause of the vulnerability is twofold: first, the underlying callback functions fail to validate user capabilities using WordPress permission checks such as current_user_can(); second, the AJAX actions rely on a security nonce that is improperly exposed and published on the public frontend of the website.\nThe attack flow proceeds as follows: an attacker authenticated with low privileges, such as a standard subscriber account, browses the public frontend of the WordPress site where the ProSolution WP Client plugin is active. By inspecting the HTML source code or script variables, the attacker harvests the exposed AJAX security nonce. Armed with this valid nonce, the attacker crafts an HTTP POST request targeting the WordPress AJAX handler endpoint (admin-ajax.php) while specifying the vulnerable administrative action parameters. Because the backend code lacks capability verification, the application accepts the request based solely on the presence of the valid nonce. Upon successful processing, the server triggers the administrative data synchronization routine or purges the activity logs depending on the invoked action.\nThe technical parameters governing this flaw include network exposure via the standard WordPress HTTP interface, low privilege and authentication requirements bounded only to valid user accounts (such as subscribers), and direct manipulation of plugin states. The payload behavior involves standard AJAX request formatting directed at administrative hooks, resulting in unauthorized administrative state changes and the potential destruction of audit trails via the deletion of activity records. Post-exploitation impact is limited to the functional scope of the targeted AJAX actions, which include data synchronization disruptions and the removal of logging data, thereby impairing system auditing and monitoring capabilities."
}