PT-2026-31314 · WordPress · Prosolution Wp Client

Nabil Irawan · Published 2026-04-08 · Updated 2026-04-27 · CVE-2026-2942

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProSolution WP Client plugin for WordPress versions up to and including 1.9.9

Description The ProSolution WP Client plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the proSol fileUploadProcess function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations Update the ProSolution WP Client plugin to a version newer than 1.9.9.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-2942

Affected Products

Prosolution Wp Client

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-2942 · Security Note
• https://twitter.com/CVEnew/status/2041975616614920517 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3852aef6-42e7-4b71-a1ba-dd41284fd07b?source=cve · Note
• https://twitter.com/ctiwatchcloud/status/2042210932495929764 · Twitter Post
• https://twitter.com/HurayraIIT/status/2041798761274565050 · Twitter Post
• https://plugins.trac.wordpress.org/browser/prosolution-wp-client/trunk/public/class-prosolwpclient-public.php?rev=3331282#L993 · Note
• https://plugins.trac.wordpress.org/changeset/3484577/prosolution-wp-client · Note
• https://twitter.com/CveFindCom/status/2042093427576156349 · Twitter Post
• https://twitter.com/0dayPublishing/status/2041948469787492701 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2048728105485812169 · Twitter Post
• https://twitter.com/OrizonCyber/status/2041961788929945873 · Twitter Post