CVE-2026-19053 PUBLISHED

ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter

Assigner: WPScan
Reserved: 06.08.2026 Published: 10.08.2026 Updated: 10.08.2026

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.

Product Status

Vendor Unknown
Product ProSolution WP Client
Versions Default: unaffected
  • affected from 0 to 2.0.6 (excl.)

Credits

  • Pablo González Pérez finder
  • Francisco José Ramírez Vicente finder
  • and Iñigo Sánchez Enciso finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE