Arbitrary File Deletion Vulnerability in ProSolution WP Client Plugin for WordPress

CVE-2026-14524

What is CVE-2026-14524?

The ProSolution WP Client plugin for WordPress contains a vulnerability that allows unauthorized users to delete files from the server. This issue arises from insufficient validation of file paths in the proSol_fileDeleteProcess function, affecting all versions up to and including 2.0.8. An attacker can exploit this vulnerability by first invoking the proSol_fileUploadModalProcess to insert a path-traversal key into their session and subsequently calling proSol_fileDeleteProcess with the compromised key, which could enable the deletion of critical files such as wp-config.php. This weakness poses serious risks, including the potential for remote code execution.

References