CVE-2026-6555
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
The ProSolution WP Client plugin for WordPress up to version 2.0.0 has an arbitrary file upload vulnerability due to array validation mismatch – only the first file is validated, but all are uploaded.
Risk Assessment
An unauthenticated attacker can upload a malicious PHP file and achieve remote code execution on the WordPress server.
Recommendation
Update the ProSolution WP Client plugin to a version later than 2.0.0.
Original NVD description (English source)
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.