The ProSolution WP Client WordPress plugin versions prior to 2.0.9 contain a CWE-918 SSRF vulnerability. The plugin does not perform validation on user-supplied URLs nor check the requester's permissions or nonce before performing server-side HTTP requests. This flaw enables any authenticated user to coerce the server into making arbitrary HTTP requests to internal or external systems, potentially leading to information disclosure or interaction with internal services not otherwise accessible.

An attacker with any authenticated user account, including low-privilege roles, can exploit this vulnerability to make the server send arbitrary HTTP requests to internal or external systems. This could lead to unauthorized access to internal services, information disclosure, or interaction with backend systems that are not directly accessible from outside the network. The vulnerability does not require high privileges to exploit, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles that can access the vulnerable functionality or implement web application firewall rules to detect and block SSRF attempts targeting internal resources. Monitor for updates from the vendor regarding patches or official mitigations.