What is the CVSS score of CVE-2026-6555?

CVE-2026-6555 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ProSolution WP Client are affected by CVE-2026-6555?

ProSolution WP Client WordPress plugin (versions 2.0.0 and earlier) contains a critical unauthenticated remote code execution vulnerability that allows attackers to upload malicious PHP files to any…

How to fix or mitigate CVE-2026-6555?

Within 24 hours: Identify all WordPress installations running ProSolution WP Client plugin version 2.0.0 or earlier; disable and remove the plugin from all instances immediately. Within 7 days: Confirm plugin removal across all inventory; scan web-accessible directories and application logs for evidence of unauthorized PHP file uploads or suspicious execution. Within 30 days: Monitor vendor advisories for a patched version (no timeline currently available); if patch is released, audit affected systems before reinstalling.

ProSolution WP Client CVE-2026-6555

EUVD-2026-31016 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-20 Wordfence

GHSA-pwg9-vp4w-mc97

File Upload PHP WordPress RCE Prosolution Wp Client

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:30 vuln.today

DescriptionCVE.org

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.

AnalysisAI

Unauthenticated remote code execution in the ProSolution WP Client WordPress plugin (versions ≤ 2.0.0) allows attackers to upload malicious PHP files to a web-accessible directory by abusing an array validation mismatch in its upload handler. Because only the first file in a multi-file upload array is checked for extension and MIME type while the remaining files are processed unchecked, attackers can pair a benign first file with a PHP webshell to achieve full code execution on the host. No public exploit identified at time of analysis, but the high CVSS 9.8 score and trivially scriptable nature place this in the realistic mass-exploitation tier for WordPress plugins.

Technical ContextAI

The vulnerability sits in the plugin's file upload pipeline, specifically in class-prosolwpclient-public.php and includes/UploadHandler.php (referenced at lines 384, 998, 1072, and 1345 in tag 2.0.0). It is a textbook CWE-434 (Unrestricted Upload of File with Dangerous Type) condition caused by a validation/iteration mismatch: the plugin validates extension and MIME type only against the first element of the uploaded file array, then iterates over the entire array when moving files to the destination. The destination is a web-accessible directory under the WordPress installation, meaning any PHP file landed there can be executed by simply requesting its URL through the web server. The affected CPE is cpe:2.3:a:prosolution:prosolution_wp_client:*:*:*:*:*:*:*:*, covering all versions up to and including 2.0.0.

RemediationAI

No vendor-released patch identified at time of analysis - the input data references only the vulnerable trunk and 2.0.0 tag on plugins.trac.wordpress.org with no fixed version cited. Until a patched release is published, site operators should deactivate and remove the ProSolution WP Client plugin entirely; if business need prevents removal, restrict access to the plugin's upload endpoints via a web application firewall (Wordfence rules being the natural fit given they reported the issue) and deny PHP execution in the plugin's upload destination directory by dropping a tightened .htaccess or equivalent server-level rule (trade-off: legitimate uploads of executable file types in that directory will also break, which is the desired security outcome). Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0b870d35-7e10-4fb5-8c3b-2bf299d1f3d5?source=cve for the fixed version and upgrade as soon as it is released. After remediation, audit the WordPress uploads directory for unexpected .php, .phtml, or .phar files indicative of prior exploitation.