ProSolution WP Client CVE-2026-14524

The ProSolution WP Client plugin must be installed and active at version 2.0.8 or earlier, and the attacker must first obtain the publicly exposed frontend nonce (trivially readable from any page that renders the plugin's UI). Exploitation is a mandatory two-step sequence: call proSol_fileUploadModalProcess to store a path-traversal key in the attacker's own session, then call proSol_fileDeleteProcess passing that key as the filename parameter; a single delete call alone is insufficient. No authentication, no privileged account, and no victim interaction are required (PR:N/UI:N). The primary limiting factors are simply that the vulnerable plugin be present and active and that the target file be within reach of and deletable by the web-server user.

This is a genuine high priority, not an inflated CVSS: the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H) aligns with the description's unauthenticated, single-nonce, two-request exploitation, and arbitrary deletion of wp-config.php is a well-understood, reliable path to remote code execution and site takeover. No EPSS score, KEV listing, or public POC is present in the supplied intelligence, so exploitation is not confirmed in the wild and the risk is currently potential rather than observed; however, the low attack complexity and the fact that the enabling nonce is publicly rendered mean weaponization would be straightforward, so even a mid-sized municipal IT team in gniezno running this plugin should treat this as urgent rather than deferring on the absence of an exploit. The main mitigating factor is deployment scale: this is a niche plugin, so the population of exposed sites is likely small even though each exposed site is fully at risk.

An unauthenticated attacker loads any public page that renders the plugin's frontend nonce, then sends an admin-ajax request to proSol_fileUploadModalProcess to poison their session with a '../../../wp-config.php' traversal key, and follows with a proSol_fileDeleteProcess request using that key as the filename to delete wp-config.php. With the config gone WordPress can be re-driven through its installer or the site otherwise coerced into an attacker-controlled state, yielding remote code execution; no public POC is currently identified but the sequence is directly derived from the vendor description.