Executive brief
The ProSolution WP Client WordPress plugin is used to manage job listings and candidate data integration with external systems. Versions before 2.0.9 fail to verify user permissions on two administrative AJAX actions, allowing any logged-in user (even with minimal privileges like a Subscriber) to clear activity logs and force data re-synchronization—actions normally restricted to administrators. This enables unauthorized tampering with plugin records and potential data disruption.
Technical details
The vulnerability is a missing capability check (CWE-862) on two AJAX handlers: proSol_ajaxClearlog and proSol_ajaxTablesync. The nonce required to invoke these actions is publicly exposed in the frontend job-portal page source code, making it accessible to any authenticated user. An attacker with a subscriber account can extract the nonce from the public page, then POST requests to wp-admin/admin-ajax.php to trigger administrative operations: clearing the activity log and truncating/re-syncing plugin data tables. No additional CSRF protection is enforced beyond the weak public nonce. The fix was released in version 2.0.9.
Affected products
- ProSolution ProSolution WP Client before 2.0.9
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in version 2.0.9