Arbitrary File Upload Vulnerability in ProSolution WP Client Plugin for WordPress

CVE-2026-16098

What is CVE-2026-16098?

The ProSolution WP Client plugin for WordPress contains a vulnerability that allows unauthenticated attackers to upload arbitrary files. This is facilitated by the proSol_handleFileUpload function, which lacks adequate validation of the Content-Disposition header, enabling attackers to manipulate filenames and potentially upload executable files. Furthermore, the nonce used to access the upload handler is publicly exposed through wp_localize_script, allowing bypass of security measures. This flaw poses a significant risk as it makes remote code execution feasible.

References