Prosolution Wp Client Vulnerabilities

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filena...

CVSS:

9.8

Affected:

up to 2.0.10

Fixed in:

2.0.11

Disclosed:

Aug 15, 2026

CVE-2026-16098 on NVD →

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can e...

CVSS:

9.1

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Aug 15, 2026

CVE-2026-14524 on NVD →

The ProSolution WP Client plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 2.0.8. This is due to a missing capability check on the proSol_url_validate() AJAX handler allowing any authenticated user to trigger outbound requests to arbitrary URLs, combined with a lack of...

CVSS:

6.4

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Aug 10, 2026

CVE-2026-19050 on NVD →

The ProSolution WP Client plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Aug 10, 2026

CVE-2026-19052 on NVD →

The ProSolution WP Client plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL qu...

CVSS:

7.5

Affected:

up to 2.0.5

Fixed in:

2.0.6

Disclosed:

Aug 6, 2026

CVE-2026-19053 on NVD →

The ProSolution WP Client plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL qu...

CVSS:

7.5

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Aug 6, 2026

CVE-2026-19049 on NVD →

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-acces...

CVSS:

9.8

Affected:

up to 2.0.0

Fixed in:

2.0.1

Disclosed:

May 19, 2026

CVE-2026-6555 on NVD →

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol_fileUploadProcess' function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server...

CVSS:

9.8

Affected:

up to 1.9.9

Fixed in:

2.0.0

Disclosed:

Apr 8, 2026

CVE-2026-2942 on NVD →