A critical SQL injection vulnerability in the ProSolution WP Client plugin allows unauthenticated attackers to compromise sensitive database information and perform unauthorized data deletion.

The plugin fails to sanitize cookie values before incorporating them into SQL queries. Because this processing occurs on every request without authentication or capability checks, unauthenticated users can perform blind or error-based SQL injection to exfiltrate or delete data.

Successful exploitation of this vulnerability poses a severe risk to data confidentiality and integrity. An attacker can extract sensitive user information or business records from the underlying database, or potentially disrupt operations by deleting critical plugin data. With a CVSS score of 8.6, this flaw is categorized as high severity and represents a significant exposure for any organization utilizing this plugin.

Immediate Action: Update the ProSolution WP Client plugin to version 2.0.9 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review web server and database access logs for unusual patterns, such as unexpected SQL syntax characters or error strings appearing in cookie headers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious SQL injection attempts targeting cookie parameters.

Public Exploit Available: No (exploit_available: unknown)

Given the ease of exploitability and the potential for total data compromise, administrators should treat this update with high priority. Ensure the ProSolution WP Client plugin is patched to version 2.0.9 across all production environments immediately to eliminate this unauthenticated entry point.