CVE-2026-6555: ProSolution WP Client arbitrary file upload in UploadHandler

CVE-2026-6555 · Severity: critical · CVSS 9.8 · Published 2026-05-20

The ProSolution WP Client plugin for WordPress, which manages client interactions and file uploads, contains a critical security flaw. An attacker can bypass security checks to upload malicious files to the website. This could allow a remote attacker to take full control of the website, potentially leading to data theft or a complete service shutdown.

Technologies: ProSolution WP Client. Vendors: ProSolution.

Quick answers

Is CVE-2026-6555 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6555 being exploited in the wild.
How severe is CVE-2026-6555?
Critical severity, with a CVSS score of 9.8, published 20 May 2026.
Which products and versions are affected?
ProSolution WP Client up to, and including, 2.0.0.
Is there a fix for CVE-2026-6555?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6555 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-6555?
Check whether you run ProSolution WP Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ProSolution WP Client plugin for WordPress (up to version 2.0.0) is vulnerable to unrestricted arbitrary file uploads due to a validation logic error in its upload handler. Specifically, an array validation mismatch exists where the plugin only performs extension and MIME type checks on the first file in an upload array, yet proceeds to process and save all files in the array to a web-accessible directory. An unauthenticated attacker can exploit this by submitting a multi-file upload request where the first file is legitimate (e.g., an image) and subsequent files are malicious PHP scripts. Successful exploitation results in remote code execution (RCE) on the underlying web server.

Affected products

  • ProSolution ProSolution WP Client up to, and including, 2.0.0

Timeline

  • 2026-05-20: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.