EUVD-2026-59855
GHSA-7vxm-f6w4-qrp3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Nonce is publicly leaked so PR:N holds; remote, no interaction, and file-upload-to-RCE yields full C:H/I:H/A:H on the host, matching the vendor score.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filename before the file is saved, and a post-save extension check that fails to delete the already-written file. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce required to reach the upload handler is publicly exposed via wp_localize_script on any front-end page rendering the job portal shortcode, allowing unauthenticated visitors to obtain a valid nonce and bypass that gating check entirely.
AnalysisAI
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugin in all versions through 2.0.10, via the proSol_handleFileUpload function. The handler trusts the attacker-supplied Content-Disposition filename over the validated multipart filename and, critically, fails to delete files that its post-save extension check rejects, so a malicious PHP file remains on disk and executable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site render the plugin's job-portal shortcode on at least one publicly reachable front-end page - that shortcode is the specific feature that both exposes the reachable proSol_handleFileUpload handler and leaks a valid nonce via wp_localize_script, so sites that never place the shortcode on a public page are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a paper-tiger high CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker loads a public site page containing the job-portal shortcode, scrapes the valid nonce embedded by wp_localize_script, then sends a crafted multipart upload whose Content-Disposition filename ends in .php while the multipart filename appears benign. The plugin writes the PHP payload to disk before its extension check rejects it - but never deletes it - leaving a web-accessible webshell the attacker requests directly to run arbitrary code. … |
| Remediation | Update to a fixed release above 2.0.10 as soon as the vendor publishes one; the input data does not include a confirmed fixed version, so no vendor-released patch version is independently confirmed at time of analysis - monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/3c4a7aef-09ec-4d17-87d6-f507d64e0afa?source=cve) and the plugin changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3644463%40prosolution-wp-client&new=3644463%40prosolution-wp-client) for the patched tag. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately audit all WordPress installations for the ProSolution WP Client plugin and deactivate it at the administration panel to prevent exploitation; if the plugin's functionality is critical, begin identifying replacement solutions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prosolution Wp Client
View allSQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.6) lets remote attackers inject SQL
Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrar
Server-side request forgery in ProSolution WP Client WordPress plugin (all versions before 2.0.9) allows any authenticat
Unauthenticated remote code execution in the ProSolution WP Client WordPress plugin (versions ≤ 2.0.0) allows attackers
Unauthenticated arbitrary file upload in ProSolution WP Client plugin (≤1.9.9) enables attackers to upload executable fi
Arbitrary file deletion in the ProSolution WP Client WordPress plugin (all versions through 2.0.8) lets unauthenticated
Missing authorization on two administrative AJAX endpoints in ProSolution WP Client WordPress plugin before 2.0.9 allows
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today