Unauthenticated SQL Injection via Unsanitized Cookie Values

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The ProSolution WP Client WordPress plugin contains a critical SQL injection vulnerability (CWE-89) that allows unauthenticated attackers to execute arbitrary SQL queries by manipulating cookie values. Because the vulnerable code processes cookies on every request without authentication checks or capability validation, any visitor to a WordPress site running the affected plugin versions can read sensitive database contents or delete plugin-stored records. This affects all organizations using ProSolution WP Client before version 2.0.9, with particular risk to businesses relying on this plugin for client management functionality.

Casky's 322 matched security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across two MITRE ATT&CK techniques: Initial Access (TA0001) through unauthenticated exploitation, and Exfiltration (TA0043) via unauthorized data access. Practitioners using Casky would identify findings showing cookie injection payloads in HTTP requests, unusual SQL query patterns in database logs, unexpected database deletions correlating with plugin activity, and failed authentication bypass attempts—all correlated against known SQL injection signatures and WordPress plugin exploitation patterns. The skills would flag the absence of input sanitization checks and the presence of unauthenticated, capability-unrestricted code paths as critical control gaps.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19049.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-19049

Casky has 322 skills that investigate the attack patterns behind CVE-2026-19049. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn