Is CVE-2026-19053 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19053 being exploited in the wild.

How severe is CVE-2026-19053?

Critical severity, with a CVSS score of 9.1, published 10 August 2026.

Which products and versions are affected?

ProSolution WP Client before 2.0.6.

Is there a fix for CVE-2026-19053?

A patch was published on 2026-08-10: version 2.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19053 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-19053?

Check whether you run ProSolution WP Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19053: ProSolution WP Client SQL injection via jobID parameter

CVE-2026-19053 · Severity: critical · CVSS 9.1 · Published 2026-08-10

The ProSolution WP Client WordPress plugin is used to manage job postings and recruitment on websites. Versions before 2.0.6 contain a blind SQL injection vulnerability in the job application form that can be exploited by anyone without authentication. An attacker can extract sensitive data from the website's database, including administrator credentials and other confidential information, by measuring response times to craft database queries.

Technologies: ProSolution WP Client. Vendors: ProSolution.

Quick answers

Is CVE-2026-19053 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19053 being exploited in the wild.
How severe is CVE-2026-19053?: Critical severity, with a CVSS score of 9.1, published 10 August 2026.
Which products and versions are affected?: ProSolution WP Client before 2.0.6.
Is there a fix for CVE-2026-19053?: A patch was published on 2026-08-10: version 2.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19053 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-19053?: Check whether you run ProSolution WP Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ProSolution WP Client WordPress plugin fails to sanitize and escape the 'jobID' parameter before using it in a SQL query within the AJAX action 'proSol_applicationSubmitProcess'. This unauthenticated blind SQL injection vulnerability allows attackers to extract arbitrary data from the WordPress database using time-based inference (SLEEP() delays). The vulnerable code accepts the jobID parameter in an unquoted numeric context, bypassing WordPress request slashing protections. Prerequisites include the plugin being activated with API settings configured and Recruitment mode enabled, but no authentication or special user interaction is required. An attacker can enumerate the database character-by-character by crafting requests that delay responses when injected conditions evaluate to true. The vulnerability is fixed in version 2.0.6.

Affected products

ProSolution WP Client before 2.0.6

Timeline

2026-08-06: disclosed
2026-08-10: advisory
2026-08-10: patched: version 2.0.6 released

References

https://wpscan.com/vulnerability/c9bad349-d2d6-4b67-a107-818f25d9bf76/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.