CVE-2026-2942: ProSolution WP Client WordPress Plugin - Unrestricted File Upload
The ProSolution WP Client plugin for WordPress is affected by an unrestricted file upload weakness in all versions up to and including 1.9.9. According to the record, unauthenticated attackers may upload arbitrary files, which may make remote code execution possible. The record rates the issue 9.8 (Critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.
Overview
The ProSolution WP Client plugin for WordPress contains an unrestricted file upload weakness (CWE-434) in the function 'proSol_fileUploadProcess'. According to the record, the function lacks file type validation in all versions up to and including 1.9.9. Reference details are available in the Wordfence entry.
Impact
- Per the record, unauthenticated attackers may upload arbitrary files to the affected server.
- The record states that this may make remote code execution possible.
- The record gives a CVSS 3.1 base score of 9.8 (Critical), with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
Affected products and versions
- ProSolution WP Client plugin for WordPress, all versions up to and including 1.9.9.
- The record contains no structured affected or fixed version data. Confirm the exact range against the vendor and the cited sources before acting on it.
Exploitation status
No confirmed exploitation appears in the sources consulted. This CVE is not listed in the CISA KEV catalog according to the record. The record includes EPSS values of 0.01067 (probability) and 0.63901 (percentile).
Remediation and mitigation
- The record does not identify a fixed version. Check the plugin changeset and the vendor channels for the current release, then update to the latest version available.
- If an update cannot be applied immediately, consider deactivating the plugin while it is not essential.
- Limit access to upload functionality where feasible, and review web application firewall rules for file upload abuse.
- Ensure upload directories are configured so that uploaded files cannot be executed as scripts.
Detection guidance
- Review web server and application logs for unexpected requests associated with the plugin's upload handling.
- Inspect WordPress upload and plugin directories for unfamiliar or recently created files, especially script files.
- Monitor for unexpected administrative accounts and unexplained changes to site files.
Limitations of the available information
- The record has no structured affected or fixed version data, and its source status is Deferred.
- Proof-of-concept availability, real-world exploitation and the contents of the changeset are not described in the record.
- The EPSS date in the record (2026-10-13) is later than the publication date (2026-04-08), so the EPSS values should be treated with caution.
Frequently asked questions
Which versions of the ProSolution WP Client plugin are affected?
According to the record, all versions up to and including 1.9.9 are affected. The record does not provide structured version data, so confirm the range with the vendor and cited sources.
Can an attacker exploit this without logging in?
The record states that unauthenticated attackers may upload arbitrary files, which may make remote code execution possible. It also gives a CVSS 3.1 vector with no privileges required.
Is there confirmed exploitation in the wild?
No confirmed exploitation appears in the sources consulted, and the record does not list this CVE in the CISA KEV catalog.
What should administrators do now?
Check for a fixed version from the vendor or the plugin repository changeset, update when available, and consider deactivating the plugin if it is not essential. Review upload directories and logs in the meantime.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.