CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol_fileUploadProcess' function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
ProSolution WP Client versions up to 1.9.9 contain an unrestricted file upload vulnerability. An attacker can upload arbitrary files to the site without authentication, potentially gaining the ability to run their own code. This affects all installations of the affected versions and requires immediate patching.
What an attacker can do
Upload arbitrary files to the site and execute code without needing to log in.
Potential impact on your site
Attackers can take full control of your site, steal data, modify content, or use it to attack visitors.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
