Description

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filename before the file is saved, and a post-save extension check that fails to delete the already-written file. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce required to reach the upload handler is publicly exposed via wp_localize_script on any front-end page rendering the job portal shortcode, allowing unauthenticated visitors to obtain a valid nonce and bypass that gating check entirely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-16T05:16:47.667Z",
  "pubdate": "2026-08-16T05:16:47.667Z",
  "executiveSummary": "The ProSolution WP Client plugin for WordPress, in all versions up to and including 2.0.10, contains an Arbitrary File Upload vulnerability via the proSol_handleFileUpload function. This security defect allows unauthenticated remote attackers to upload arbitrary files, potentially leading to remote code execution on the underlying server.\nThe root cause stems from missing input validation on the attacker-controlled Content-Disposition header filename, which incorrectly overrides the allow-listed multipart filename prior to saving. Furthermore, a flawed post-save extension check fails to delete the already-written file. Attackers can abuse this mechanism by extracting a publicly exposed nonce via wp_localize_script on any front-end page rendering the job portal shortcode, thereby bypassing the initial gating check entirely without requiring authentication or privileges.\nThe risk implications are severe, as successful exploitation grants arbitrary file write capabilities, enabling attackers to execute malicious code within the context of the web server user. Remediation requires updating the plugin to a patched version once available or restricting access to the vulnerable upload handler.",
  "technicalDetails": "The vulnerability resides within the ProSolution WP Client plugin for WordPress, specifically affecting all versions up to and including 2.0.10. The vulnerable component is the file upload handling routine implemented by the proSol_handleFileUpload function.\nThe root cause of the vulnerability is a combination of improper input validation and deficient post-processing logic. Specifically, the upload handler processes an attacker-controlled Content-Disposition header filename, which explicitly overrides the securely established allow-listed multipart filename before the file is persisted to disk. Additionally, the subsequent post-save extension validation check contains a logical flaw whereby it fails to purge the already-written file from the filesystem if the extension does not meet safety criteria.\nExploitation of this vulnerability requires interacting with the publicly exposed nonce mechanism. The nonce necessary to successfully reach and execute the upload handler is inadvertently disclosed via wp_localize_script on any front-end page rendering the job portal shortcode. Consequently, unauthenticated remote attackers can query these front-end pages over the network, extract a valid nonce, and completely bypass the security gating check designed to restrict access to the upload function.\nThe step-by-step attack flow proceeds as follows: First, an unauthenticated attacker visits a front-end page containing the job portal shortcode and parses the source code to extract the exposed nonce injected via wp_localize_script. Second, the attacker crafts a malicious HTTP POST request targeting the upload handler governed by proSol_handleFileUpload, supplying the harvested nonce along with a multi-part payload. Third, the payload incorporates a manipulated Content-Disposition header containing a malicious filename (such as a PHP web shell) designed to override the allow-listed filename. Fourth, the server writes the file to disk based on the attacker-controlled header. Finally, despite any subsequent post-save extension checks, the file persists due to the failure to delete the written artifact, allowing the attacker to directly access and execute the uploaded script via direct HTTP requests to achieve remote code execution."
}