Arbitrary File Deletion in ProSolution WP Client WordPress Plugin

Executive Summary

The ProSolution WP Client plugin for WordPress has a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation in the proSol_fileDeleteProcess function. This flaw exists in all versions up to and including 2.0.8.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves arbitrary file deletion in the ProSolution WP Client WordPress plugin. To detect it, check for unauthorized file deletions in server logs, especially around the plugin's functions. Look for suspicious calls to proSol_fileDeleteProcess or proSol_fileUploadModalProcess in access logs. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution if critical files like wp-config.php are deleted. Attackers can exploit it by first poisoning their session with a path-traversal key and then calling the vulnerable function with that key as the filename parameter.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file deletion, including critical files like wp-config.php, potentially exposing sensitive data. For GDPR, this may result in unauthorized access to personal data, triggering breach notification requirements. For HIPAA, it could compromise protected health information if such data is stored on the affected WordPress site.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the ProSolution WP Client plugin to the latest version beyond 2.0.8. If an update is unavailable, disable or remove the plugin entirely. Review server files for unauthorized deletions, particularly wp-config.php. Restrict file deletion permissions and monitor for suspicious activity.

Useful 0 Not Useful 0