The ProSolution WP Client WordPress plugin versions prior to 2.0.9 contain an SQL injection vulnerability (CWE-89) due to improper sanitization of a cookie value used directly in SQL queries. The plugin processes this cookie on every request without verifying user authentication or capabilities, enabling unauthenticated attackers to read and delete arbitrary data from the plugin's database tables. This vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

An unauthenticated attacker can exploit this vulnerability to read sensitive data from the plugin's database and delete records managed by the ProSolution WP Client plugin. This compromises data confidentiality and integrity within the affected plugin's scope. There is no indication of impact on system availability or broader WordPress site functionality beyond the plugin's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin or disable it if possible to prevent exploitation. Monitor for updates from the vendor regarding patches or mitigations.