The ProSolution WP Client WordPress plugin before version 2.0.9 fails to sanitize a cookie named 'removesite' before using it in SQL queries, and processes the cookie on every request without any authentication or capability check. This flaw allows attackers to inject arbitrary SQL code, resulting in unauthorized reading of sensitive database data and deletion of plugin‑stored records. The weakness is a classic SQL injection (CWE‑89) which can lead to both data confidentiality and integrity violations.

Any WordPress site using the ProSolution WP Client plugin older than 2.0.9 is affected. No specific vendor or version range beyond the stated release is provided by the CNA. The vulnerability resides in the plugin’s handling of the 'removesite' cookie, and all affected deployments share the same flaw without further differentiation.

An attacker only needs to supply a malicious 'removesite' cookie in an HTTP request to the target site; no authentication is required. The vulnerability carries a CVSS score of 8.6 and an EPSS of <1%, and it is not listed in the CISA KEV catalog, but the lack of authentication and ability to delete data make it a high‑risk issue. The exploit path is straightforward: send a crafted cookie, trigger the vulnerable code, and execute arbitrary SQL to read or delete data, potentially compromising the entire WordPress installation’s integrity.