Description

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-10T07:16:51.047Z",
  "pubdate": "2026-08-10T07:16:51.047Z",
  "executiveSummary": "An unauthenticated Blind SQL Injection vulnerability has been identified in the ProSolution WP Client WordPress plugin prior to version 2.0.6. The flaw exists due to the lack of proper input sanitization and contextual escaping on a specific parameter before it is dynamically concatenated into an underlying SQL statement. This security deficit allows remote, unauthenticated threat actors to interact directly with the database abstraction layer, posing severe risks to data confidentiality and integrity.\nBecause the vector is reachable by unauthenticated visitors over the network, successful exploitation requires zero prior access or privileged credentials, significantly lowering the attack barrier. The impact of a blind SQL injection typically manifests as the capability to enumerate database schemas, extract sensitive application data including user credentials and proprietary business records, and potentially compromise the underlying hosting infrastructure depending on database user privileges and database server configurations. Mitigation strictly requires updating the ProSolution WP Client plugin to version 2.0.6 or later, where proper parameterization and input handling are implemented.",
  "technicalDetails": "The vulnerability resides within the ProSolution WP Client WordPress plugin, specifically affecting all versions prior to 2.0.6. The root cause of the flaw is insufficient input sanitization and the absence of output escaping for user-supplied data handling parameters. When input data is passed via an HTTP request, the application insecurely concatenates the raw parameter directly into a dynamic SQL query string executed by the database management system.\nThe vulnerable component is exposed via HTTP/HTTPS to unauthenticated visitors across the network, requiring no pre-existing user accounts or authentication tokens to trigger the vulnerable code path. Because the application fails to validate, sanitize, or parameterize the input, an attacker can supply specially crafted SQL payload structures designed to manipulate the logical evaluation of the query.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies the vulnerable HTTP endpoint managed by the ProSolution WP Client plugin. Second, the attacker crafts an HTTP request containing malicious SQL syntax injected into the vulnerable parameter. This payload typically incorporates conditional statements, time-based delay functions, or boolean logic operators (e.g., SLEEP() or benchmark functions) characteristic of blind SQL injection vulnerabilities where explicit error messages or query results are not directly reflected in the HTTP response.\nThird, the plugin processes the request and incorporates the tainted parameter directly into the SQL execution statement without utilizing prepared statements, parameterized queries, or strict type casting. Fourth, the database server executes the modified query. Depending on whether the injected logical condition evaluates to true or false, or whether a time delay is successfully triggered, the attacker infers the structure and content of the database iteratively.\nThe post-exploitation impact includes unauthorized data extraction, including sensitive user information, administrative credentials, and system configuration details stored within the WordPress database. Furthermore, advanced exploitation vectors could leverage database-specific functionalities to execute operating system commands or pivot deeper into the network if the database server is misconfigured."
}