Summary
CVE-2026-16098 is a critical Unrestricted File Upload vulnerability (CWE-434) affecting the ProSolution WP Client WordPress plugin in all versions up to and including 2.0.10. The flaw resides in the plugin’s proSol_handleFileUpload function, which fails to properly validate the filename supplied in the Content-Disposition header of a multipart upload request, allowing attackers to upload and execute arbitrary files. Because the nonce required to reach the upload handler is publicly exposed on any front-end page rendering the plugin’s job portal shortcode, the vulnerability is exploitable by completely unauthenticated attackers, resulting in a CVSS v3.1 score of 9.8 (Critical).
Technical details
- Root cause: The
proSol_handleFileUploadfunction trusts the filename provided in the Content-Disposition header of an uploaded multipart file part rather than strictly validating it against an allow-list, letting an attacker override the extension that the plugin believes it is saving. - Post-save validation gap: Extension checks are performed only after the file has already been written to disk, and the plugin does not delete files that fail this later check — meaning a malicious executable file (e.g., a
.phpfile) can persist on the server even if it is flagged as disallowed. - Authentication bypass: The nonce that is supposed to protect the file-upload AJAX endpoint is publicly exposed via
wp_localize_scripton any front-end page that renders the plugin’s job portal shortcode, so no authentication or session is required to obtain a valid nonce and reach the vulnerable handler. - Attack vector: Remote, over the network, requiring no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N).
- Impact: Successful exploitation allows an unauthenticated attacker to upload a web shell or other executable payload to a web-accessible directory, leading to remote code execution and full compromise of the WordPress site’s confidentiality, integrity, and availability.
Affected software
- ProSolution WP Client (WordPress plugin) — all versions up to and including 2.0.10
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade ProSolution WP Client to a version later than 2.0.10 that remediates this issue as soon as the vendor releases a fix. At the time of publication, no confirmed patched version has been identified in the public CVE record — organizations should monitor the WordPress.org plugin changelog for an official fix and apply it immediately once available.
- If no patch is available:
- Disable or remove the ProSolution WP Client plugin, and specifically the job portal shortcode/file-upload functionality, until a fix is released.
- Restrict or block public access to the plugin’s file-upload AJAX endpoint at the web application firewall (WAF) or reverse proxy layer.
- Disable script/PHP execution in upload directories used by the plugin (e.g., via web server configuration) to prevent uploaded files from being executed even if written to disk.
- Monitor uploads directories for unexpected executable file types (e.g.,
.php,.phtml) as an indicator of exploitation attempts. - Review site file integrity and server logs for evidence of unauthorized file uploads or unusual POST requests to the plugin’s upload handler.