Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

ProSolution WP Client Plugin: Unauthenticated File Upload Risk

CVE-2026-16098 · published 19 days ago
Summary

The ProSolution WP Client plugin for WordPress has a security issue that allows hackers to upload any file to the website without needing a password. This could allow them to run malicious code on the site, potentially leading to data breaches or website damage. To stay safe, update the plugin to the latest version, which should fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
prosolution prosolution wp client <= 2.0.10
Original advisory text
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing v...
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filename before the file is saved, and a post-save extension check that fails to delete the already-written file. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce required to reach the upload handler is publicly exposed via wp_localize_script on any front-end page rendering the job portal shortcode, allowing unauthenticated visitors to obtain a valid nonce and bypass that gating check entirely.
References
Severity
9.8 Critical
CVSS 3.1: 9.8 (NVD)
Exploitation
EPSS <1%
Type
CWE-434Unrestricted File Upload
Timeline
Published16 Aug 2026
Updated3 Sep 2026
First seen16 Aug 2026
Sources
CVE-2026-16098 · NVD
CVE-2026-16098 · MITRE
Monitor software like this
Free during beta