The ProSolution WP Client WordPress plugin prior to version 2.0.6 fails to sanitise or escape the jobID parameter before using it in a SQL statement. An unauthenticated visitor can send a crafted value via HTTP directly to the plugin endpoint, causing the database engine to treat the value as part of the query text. Because the injection is blind, the attacker does not receive direct query results; however, based on the description it is inferred that the attacker could infer table structure, row counts, or even specific values by observing response timing or HTTP status codes, potentially exposing sensitive data. The flaw represents a classic SQL injection weakness (CWE‑89) that can be leveraged to read or manipulate database contents depending on the privileges of the database user.

Any WordPress site that has installed the ProSolution WP Client plugin with a version earlier than 2.0.6 is vulnerable. The vendor is listed only as Unknown:ProSolution WP Client, so the product is identified solely by the plugin name. No specific sub‑versions are noted; all releases before 2.0.6 are affected.

The vulnerability is reachable by any unauthenticated visitor; no authentication, privilege escalation, or special configuration is required. With a CVSS score of 9.1, the risk is high. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, but the presence of a blind SQL injection in a publicly accessible plugin suggests a potentially high risk of sensitive data disclosure. The lack of input validation and escaping makes exploitation straightforward for an attacker capable of sending HTTP requests, especially if the underlying database holds user credentials or payment information.