CVE-2026-16098
Received Received - Intake

Arbitrary File Upload in ProSolution WP Client Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filename before the file is saved, and a post-save extension check that fails to delete the already-written file. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce required to reach the upload handler is publicly exposed via wp_localize_script on any front-end page rendering the job portal shortcode, allowing unauthenticated visitors to obtain a valid nonce and bypass that gating check entirely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-16098
EUVD
EUVD-2026-59855

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
prosolution wp_client to 2.0.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the ProSolution WP Client WordPress plugin. It allows unauthenticated attackers to upload arbitrary files to a server by exploiting a flaw in the file upload function. The plugin fails to properly validate the filename provided in a header, allowing attackers to override the intended filename and upload potentially executable files. This can lead to remote code execution on the server.

Detection Guidance

Check for unauthorized file uploads in WordPress directories, especially in the wp-content/uploads folder. Look for files with unexpected extensions like .php, .exe, or .js. Review server logs for POST requests to /wp-admin/admin-ajax.php with parameters related to file uploads.

Impact Analysis

If you use the ProSolution WP Client plugin, attackers could exploit this to upload malicious files to your server. This could allow them to take control of your website, steal data, or use your server for further attacks. The vulnerability is severe because it requires no authentication and can be triggered by any visitor.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR or HIPAA requirements for data protection and security. If exploited, it could result in data breaches, leading to legal penalties, fines, or reputational damage for organizations handling protected information.

Mitigation Strategies

Update the ProSolution WP Client plugin to the latest version if available. Disable the plugin temporarily if no update is available. Implement strict file upload restrictions on the server, such as blocking executable file types. Monitor for suspicious activity in server logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16098. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart