A critical SQL injection vulnerability in the ProSolution WP Client WordPress plugin allows unauthenticated attackers to compromise sensitive database information.

This flaw is a blind SQL injection vulnerability (CWE-89) that occurs because the plugin fails to sanitize or escape input parameters before processing them in SQL statements. The vulnerability is reachable by unauthenticated visitors over the network.

The ability for an unauthenticated attacker to execute arbitrary SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive customer data, administrative credentials, or full site compromise, resulting in significant reputational damage and regulatory non-compliance. Given the CVSS score of 9.1, this vulnerability is classified as critical and requires immediate attention to prevent potential data breaches.

Immediate Action: Update the ProSolution WP Client plugin to version 2.0.6 or later immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, such as unexpected syntax characters or excessive time-based delays, which are indicative of blind SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeted at the WordPress plugin environment.

Public Exploit Available: No (CISA's SSVC assessment notes a proof-of-concept exists, but no weaponized exploit has been confirmed).

The severity of this vulnerability, combined with the lack of required authentication for exploitation, necessitates an immediate response. IT administrators must prioritize updating the ProSolution WP Client plugin across all affected WordPress installations to version 2.0.6. Failure to patch this vulnerability leaves the underlying database exposed to unauthorized access and potential data exfiltration.