Executive brief
The ProSolution WP Client WordPress plugin is used to manage job postings and recruitment on websites. Versions before 2.0.6 contain a blind SQL injection vulnerability in the job application form that can be exploited by anyone without authentication. An attacker can extract sensitive data from the website's database, including administrator credentials and other confidential information, by measuring response times to craft database queries.
Technical details
The ProSolution WP Client WordPress plugin fails to sanitize and escape the 'jobID' parameter before using it in a SQL query within the AJAX action 'proSol_applicationSubmitProcess'. This unauthenticated blind SQL injection vulnerability allows attackers to extract arbitrary data from the WordPress database using time-based inference (SLEEP() delays). The vulnerable code accepts the jobID parameter in an unquoted numeric context, bypassing WordPress request slashing protections. Prerequisites include the plugin being activated with API settings configured and Recruitment mode enabled, but no authentication or special user interaction is required. An attacker can enumerate the database character-by-character by crafting requests that delay responses when injected conditions evaluate to true. The vulnerability is fixed in version 2.0.6.
Affected products
- ProSolution WP Client before 2.0.6
Timeline
- 2026-08-06: disclosed
- 2026-08-10: advisory
- 2026-08-10: patched: version 2.0.6 released