Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

ProSolution WP Client plugin for WordPress: Unauthenticated File Deletion

CVE-2026-14524 · published 19 days ago
Summary

The ProSolution WP Client plugin for WordPress allows unauthenticated attackers to delete any file on the server, including sensitive files like wp-config.php. This could lead to a complete takeover of the server. To protect your site, update the plugin to the latest version or remove it if possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
prosolution prosolution wp client <= 2.0.8
Original advisory text
ProSolution WP Client <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker must first call the proSol_fileUploadModalProcess handler to poison their own session with a path-traversal key, then call proSol_fileDeleteProcess with that key as the filename parameter; both steps require only the publicly exposed frontend nonce.
References
Severity
9.1 Critical
CVSS 3.1: 9.1 (NVD)
Exploitation
EPSS <1%
Type
CWE-22Path Traversal
Timeline
Published16 Aug 2026
Updated3 Sep 2026
First seen16 Aug 2026
Sources
CVE-2026-14524 · NVD
CVE-2026-14524 · MITRE
Monitor software like this
Free during beta