CVE-2026-6555: ProSolution WP Client arbitrary file upload in UploadHandler

CVE-2026-6555 · Severity: critical · CVSS 9.8 · Published 2026-05-20

Technologies: ProSolution WP Client. Vendors: ProSolution.

Executive brief

The ProSolution WP Client plugin for WordPress, which manages client interactions and file uploads, contains a critical security flaw. An attacker can bypass security checks to upload malicious files to the website. This could allow a remote attacker to take full control of the website, potentially leading to data theft or a complete service shutdown.

Technical details

The ProSolution WP Client plugin for WordPress (up to version 2.0.0) is vulnerable to unrestricted arbitrary file uploads due to a validation logic error in its upload handler. Specifically, an array validation mismatch exists where the plugin only performs extension and MIME type checks on the first file in an upload array, yet proceeds to process and save all files in the array to a web-accessible directory. An unauthenticated attacker can exploit this by submitting a multi-file upload request where the first file is legitimate (e.g., an image) and subsequent files are malicious PHP scripts. Successful exploitation results in remote code execution (RCE) on the underlying web server.

Affected products

ProSolution ProSolution WP Client up to, and including, 2.0.0

Timeline

2026-05-20: advisory: NVD publication date

References

Related threats

ProSolution WP Client privilege escalation in AJAX actions