CVE-2026-19049

The CVSS of 8.6 undersells this. The critical distinction is that this cookie value processes on every request without authentication—that's the severity multiplier the score doesn't capture. You're not hunting for a vulnerable endpoint; the attack surface is exposed on every HTTP interaction with the host. Mass exploitation requires no reconnaissance, no authentication, no endpoint identification. Send a crafted cookie to any request and the injection executes. Compounding this: the vulnerability supports both read and delete operations. Combined with the 'every request' characteristic, an attacker can first exfiltrate data (wp_users for password hashes, wp_options for auth salts), then delete audit logs to cover their tracks—turning a data breach into a silent, persistent compromise. The delete capability also means attackers don't need to maintain foothold through other vectors; they can destroy evidence as they go. Database privileges are a critical gap. WordPress plugins typically run under a single DB user with SELECT/DELETE across the entire database, not just plugin tables. The CVE language limiting scope to 'records the plugin stores' is misleading—MySQL permissions don't work that way. If the injection point can reach wp_users, it reaches everything that DB user can touch. For detection: most automated scanners treat cookies as transport metadata and don't actively test them for injection. A malicious cookie set once persists across the attacker's session, evading tools that log headers but don't scrutinize their values. This also creates chaining risk—any XSS or MITM that leaks cookies becomes a SQLi delivery vector. Prioritize inventory checks immediately. If you run the ProSolution plugin, assume active exploitation is possible the moment a PoC surfaces. The 'every request' exposure means there's no lateral movement required—no privileged endpoint to reach, no auth barrier to cross. Patch velocity in WordPress plugin ecosystems routinely stretches 30-90 days; this CVE doesn't give you that time.

Reviewed through automated stages and approved by a human before publication.