ProSolution WP Client CVE-2026-16098

Exploitation requires that the target WordPress site render the plugin's job-portal shortcode on at least one publicly reachable front-end page - that shortcode is the specific feature that both exposes the reachable proSol_handleFileUpload handler and leaks a valid nonce via wp_localize_script, so sites that never place the shortcode on a public page are not exposed. Given that condition, there are no further limiting factors: no authentication (the nonce is public), no user interaction, and default configurations of the plugin are affected across all versions up to and including 2.0.10. The attack also relies on the web server being willing to execute the uploaded file type (e.g., PHP execution enabled in the upload directory), which is the standard WordPress default; hardened deployments that block script execution in the uploads path materially reduce impact.

This is a genuine high-priority issue, not a paper-tiger high CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is consistent with the description: fully remote, no authentication (the nonce is publicly exposed), no user interaction, and the outcome is server-side code execution on a public-facing WordPress site - one of the most valuable targets for mass, automatable exploitation. No EPSS score, SSVC decision, or CISA KEV entry was provided in the input, and no public exploit is identified at time of analysis, so active-exploitation and probability signals are currently absent rather than negative; that absence should not be read as low risk given how mechanically simple the flaw is. WordPress arbitrary-upload-to-RCE bugs are historically favored by opportunistic mass-scanning campaigns, so even a mid-sized operator running this plugin on a low-traffic site should treat patching as urgent rather than routine. The main dampener on real-world impact is prevalence: this is a niche plugin, so exposure is limited to the specific sites that run it.

An unauthenticated attacker loads a public site page containing the job-portal shortcode, scrapes the valid nonce embedded by wp_localize_script, then sends a crafted multipart upload whose Content-Disposition filename ends in .php while the multipart filename appears benign. The plugin writes the PHP payload to disk before its extension check rejects it - but never deletes it - leaving a web-accessible webshell the attacker requests directly to run arbitrary code. No public proof-of-concept is identified at time of analysis, but the flaw is simple enough to weaponize quickly.