Description

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker must first call the proSol_fileUploadModalProcess handler to poison their own session with a path-traversal key, then call proSol_fileDeleteProcess with that key as the filename parameter; both steps require only the publicly exposed frontend nonce.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-16T05:16:46.493Z",
  "pubdate": "2026-08-16T05:16:46.493Z",
  "executiveSummary": "The ProSolution WP Client plugin for WordPress is vulnerable to an arbitrary file deletion security flaw impacting all versions up to, and including, 2.0.8. This vulnerability arises from insufficient file path validation within the file deletion processing functionality.\nSuccessful exploitation allows unauthenticated remote attackers to delete arbitrary files located on the underlying server. This capability introduces severe risk implications, as the deletion of critical system files such as wp-config.php can easily facilitate subsequent remote code execution or lead to total site compromise.\nThe attack vector is network-exposed and relies on unauthenticated access. Exploitation requires chaining two specific handlers exposed on the public frontend. First, an attacker must interact with the file upload modal process handler to poison their active session with a path-traversal key. Second, the attacker invokes the file deletion process handler, utilizing the previously generated traversal key as the filename parameter.\nBoth required execution steps rely exclusively on publicly exposed frontend nonces, bypassing traditional authentication boundaries. Consequently, this allows external threat actors to interact directly with sensitive server-side file management routines.",
  "technicalDetails": "The vulnerability resides in the proSol_fileDeleteProcess function within the ProSolution WP Client plugin, affecting all versions up to, and including, 2.0.8. The root cause of the flaw is insufficient file path validation, which fails to properly sanitize or restrict user-supplied input before passing it to file system operations.\nThe vulnerable component handles file deletion routines without adequately verifying whether the targeted file resides within the intended directory boundaries, thereby exposing the application to path traversal conditions.\nExploitation requires no prior authentication or elevated privileges, and the affected handlers are exposed over the network via the public frontend of the WordPress site. Although authentication is absent, the attack sequence requires specific sequential interactions utilizing publicly exposed frontend nonces.\nThe step-by-step attack flow proceeds as follows: First, the unauthenticated attacker issues a request to the proSol_fileUploadModalProcess handler. This action poisons the attacker's active session by injecting a path-traversal key into the session data structure.\nSecond, the attacker initiates a subsequent request to the proSol_fileDeleteProcess function, supplying the poisoned path-traversal key as the filename parameter.\nBecause path validation is insufficient, the application resolves the manipulated session key, traversing outside the intended storage directory to locate and delete the targeted arbitrary file on the server.\nThe post-exploitation impact is critical. By systematically deleting core application files or configuration assets, such as wp-config.php, an attacker can disrupt service availability, trigger installation re-initialization routines, or create conditions that enable remote code execution."
}