CVE-2026-6555
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk58th percentile — higher than 58% of all known CVEs
Summary
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory.
Risk Assessment
Unauthenticated attackers can upload malicious PHP files, leading to remote code execution. This poses a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability. Additionally, implementing further security measures, such as restricting the types of files that can be uploaded, is advisable.
Original NVD description (English source)
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.