What the vulnerability does
01Description
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.
Explanation of Vulnerability in Simple Terms
02Summary
ProSolution WP Client versions 2.0.0 and earlier allow unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can upload malicious files (such as PHP scripts) over the network with no authentication required. This can lead to complete compromise of the site, including data theft, malware installation, and site defacement.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the site and execute malicious code without authentication.
Potential impact on your site
04Site Impact
Complete site compromise: attackers can run code, steal data, install malware, or deface your site.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 20, 2026
CVE published
May 20, 2026
Record updated
