EUVD-2026-31016
GHSA-pwg9-vp4w-mc97
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconFingerprint WordPress site for plugin
-
DeliveryCraft multi-file upload request
-
ExploitSend benign first file plus PHP webshell
-
InstallBypass first-file-only validation
-
C2Webshell written to web-accessible directory
-
ExecuteRequest webshell URL to execute PHP
-
ImpactAchieve RCE and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a vulnerable version (≤ 2.0.0) of the ProSolution WP Client plugin be installed and activated on a reachable WordPress site, and that the plugin's multi-file upload endpoint be exposed to the requesting attacker (which is the default for a public WordPress front end since CVSS PR:N/UI:N applies). The attacker must construct a multi-file upload request where the first file passes the plugin's extension and MIME checks (any benign whitelisted type such as an image will suffice) and a subsequent file in the same array carries the malicious PHP payload. No authentication, user interaction, elevated privileges, or non-default configuration is required; the only practical limit is whether the WordPress installation enforces PHP execution restrictions on the uploads directory at the web server layer, which most stock LAMP/LEMP deployments do not. |
| Impact | All available signals point to high real-world risk. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates a network-reachable, low-complexity, unauthenticated, no-user-interaction attack with high impact across confidentiality, integrity, and availability - the worst-case profile. The vulnerability was reported by Wordfence, a credible source for WordPress threat intelligence, and the references include direct links to the vulnerable source lines in the WordPress plugin trac, making rediscovery and exploit development straightforward. EPSS and KEV data were not provided in the input, so probabilistic exploitation scoring and active-exploitation status cannot be confirmed from this data set; however, unauthenticated arbitrary file upload bugs in WordPress plugins are historically among the most scanned and weaponized class of issues by botnets. Treat as a high-priority patch regardless of plugin install base. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers a WordPress site running ProSolution WP Client ≤ 2.0.0 (via fingerprinting or plugin enumeration) and sends a multipart/form-data POST to the plugin's upload endpoint containing two files: a benign first file (e.g., a small valid image or PDF) that passes extension and MIME validation, followed by a malicious PHP webshell. The handler validates only the first file but processes both, dropping the webshell into a web-accessible directory; the attacker then issues an HTTP GET to the webshell URL to execute arbitrary PHP under the web server user, pivoting to data theft, WordPress account creation, or host-level compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Unauthenticated remote code execution in the ProSolution WP Client WordPress plugin (versions ≤ 2.0.0) allows attackers to upload malicious PHP files to a web-accessible directory by abusing an array validation mismatch in its upload handler. Because only the first file in a multi-file upload array is checked for extension and MIME type while the remaining files are processed unchecked, attackers can pair a benign first file with a PHP webshell to achieve full code execution on the host. No public exploit identified at time of analysis, but the high CVSS 9.8 score and trivially scriptable nature place this in the realistic mass-exploitation tier for WordPress plugins.
RemediationAI
No vendor-released patch identified at time of analysis - the input data references only the vulnerable trunk and 2.0.0 tag on plugins.trac.wordpress.org with no fixed version cited. Until a patched release is published, site operators should deactivate and remove the ProSolution WP Client plugin entirely; if business need prevents removal, restrict access to the plugin's upload endpoints via a web application firewall (Wordfence rules being the natural fit given they reported the issue) and deny PHP execution in the plugin's upload destination directory by dropping a tightened .htaccess or equivalent server-level rule (trade-off: legitimate uploads of executable file types in that directory will also break, which is the desired security outcome). Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0b870d35-7e10-4fb5-8c3b-2bf299d1f3d5?source=cve for the fixed version and upgrade as soon as it is released. After remediation, audit the WordPress uploads directory for unexpected .php, .phtml, or .phar files indicative of prior exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in the plugin's file upload pipeline, specifically in class-prosolwpclient-public.php and includes/UploadHandler.php (referenced at lines 384, 998, 1072, and 1345 in tag 2.0.0). It is a textbook CWE-434 (Unrestricted Upload of File with Dangerous Type) condition caused by a validation/iteration mismatch: the plugin validates extension and MIME type only against the first element of the uploaded file array, then iterates over the entire array when moving files to the destination. The destination is a web-accessible directory under the WordPress installation, meaning any PHP file landed there can be executed by simply requesting its URL through the web server. The affected CPE is cpe:2.3:a:prosolution:prosolution_wp_client:*:*:*:*:*:*:*:*, covering all versions up to and including 2.0.0.
Know when Prosolution Wp Client gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.
Executive ViewAI
ProSolution WP Client WordPress plugin (versions 2.0.0 and earlier) contains a critical unauthenticated remote code execution vulnerability that allows attackers to upload malicious PHP files to any affected WordPress installation. This affects all public-facing WordPress sites using this plugin and represents an immediate risk of full website and server compromise. No patch has been released; immediate plugin removal is required.
Plugin removal is the only effective interim control due to absence of vendor patch. If operational requirements prevent immediate removal, implement: (1) web application firewall rules blocking all file uploads to plugin directories, (2) disable PHP execution in plugin directories via web server configuration (.htaccess or nginx), (3) restrict filesystem write permissions on web-accessible directories, (4) enable file integrity monitoring to detect unauthorized file creation, (5) implement login-based WordPress dashboard access restrictions. These are temporary only and do not eliminate exploitation risk-plugin removal must remain priority.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Prosolution Wp Client
View allSQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.6) lets remote attackers inject SQL
Server-side request forgery in ProSolution WP Client WordPress plugin (all versions before 2.0.9) allows any authenticat
Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrar
Missing authorization on two administrative AJAX endpoints in ProSolution WP Client WordPress plugin before 2.0.9 allows
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugi
Unauthenticated arbitrary file upload in ProSolution WP Client plugin (≤1.9.9) enables attackers to upload executable fi
Arbitrary file deletion in the ProSolution WP Client WordPress plugin (all versions through 2.0.8) lets unauthenticated
Exploit-DB