CVE-2026-6555: ProSolution WP Client
CVE-2026-6555 affects the ProSolution WP Client plugin for WordPress in versions up to and including 2.0.0. According to the record, only the first file in an upload array is validated for extension and MIME type, while all files are stored in a web-accessible directory, which may allow unauthenticated arbitrary file upload. The CNA rates it critical with a CVSS 3.1 score of 9.8, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-6555 is an unrestricted file upload weakness (CWE-434) in the ProSolution WP Client plugin for WordPress, affecting versions up to and including 2.0.0. The record states that file validation is applied only to the first entry of an upload array, while the remaining entries are still processed and stored in a web-accessible location.
Impact
The Wordfence record describes the potential outcome as remote code execution through the upload of PHP files, and assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The record indicates no privileges or user interaction are required.
Affected products and versions
- Prosolution ProSolution WP Client: versions up to and including 2.0.0.
No fixed version is listed in the record. The absence of a listed fix does not confirm that no fix exists; the status of a patched release is unknown from the sources consulted.
Exploitation status
The KEV catalog entry is not listed for this CVE in the record, so no confirmed active exploitation is reported. The SSVC fields indicate exploitation as "none" and automatable as "yes". The EPSS probability is 0.01352 (percentile 0.70828). These values are indicators, not confirmation of attacks.
Remediation and mitigation
- Identify all sites running ProSolution WP Client and confirm the installed version.
- Check the vendor or WordPress plugin repository for a release newer than 2.0.0 and apply it when available; the record does not identify one.
- Until a fixed version is verified, consider disabling or removing the plugin on internet-facing sites where it is not essential.
- Review upload directories for unexpected executable files and restrict script execution in upload locations as a defense-in-depth measure.
Detection guidance
- Review web server logs for unexpected requests to the plugin's upload functionality from unauthenticated sources.
- Monitor upload directories for newly created files with executable extensions or unexpected content types.
- Alert on requests to PHP files located in directories that should only contain media or documents.
Limitations of the available information
The record does not provide a fixed version, a confirmed proof of exploitation in the wild, or details beyond the cited references. The vendor-side advisory and the exact patch contents were not available in the record. Assessments of exploitability are based on the description and the SSVC and EPSS values provided.
Frequently asked questions
What is CVE-2026-6555?
It is an unrestricted file upload vulnerability in the ProSolution WP Client WordPress plugin, versions up to and including 2.0.0, where only the first uploaded file is validated.
Is there a fixed version?
The record does not list a fixed version. The status of a patch is unknown from the sources consulted, so check the vendor or plugin repository.
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV in this record, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.