Executive brief
ProSolution WP Client is a WordPress plugin that synchronizes job listings and related data from external sources. An unauthenticated attacker can inject SQL commands through the 'removesite' cookie on any page request, allowing them to read sensitive data from the entire WordPress database or delete all plugin data without any authentication. No user action or plugin configuration changes are required—the vulnerability is exploitable on any site with the plugin installed and activated.
Technical details
The plugin contains a SQL injection vulnerability in the processing of the 'removesite' cookie value, which is used directly in SQL queries without sanitization or parameterization. The vulnerable code processes this cookie on every HTTP request without requiring authentication or checking user capabilities, making it accessible to any unauthenticated visitor. An attacker can craft malicious cookie values using SQL injection syntax (e.g., OR 1=1 or conditional delays) to either delete arbitrary records or exfiltrate data via time-based blind SQL injection. The vulnerability affects versions before 2.0.9 and has been patched in version 2.0.9.
Affected products
- ProSolution WP Client before 2.0.9
Timeline
- 2026-08-06: disclosed: Publicly published on WPScan vulnerability database
- 2026-08-10: patched: Fixed in version 2.0.9