PT-2026-42070 · WordPress · Prosolution Wp Client

Published

2026-05-20

·

Updated

2026-05-20

·

CVE-2026-6555

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ProSolution WP Client versions prior to 2.0.1
Description The ProSolution WP Client plugin for WordPress allows unauthenticated attackers to upload malicious PHP files, potentially leading to remote code execution. This occurs due to an array validation mismatch where the system only validates the extension and MIME type of the first file in an upload array, while all subsequent files are processed and uploaded to a web-accessible directory. An attacker can exploit this by sending a valid file first, followed by a malicious one.
Recommendations Update the plugin to a version later than 2.0.0.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-6555

Affected Products

Prosolution Wp Client