A critical (CVSS 9.1) path traversal flaw in the ProSolution WP Client WordPress plugin lets unauthenticated attackers delete arbitrary files on the server, a path that can plausibly be leveraged toward remote code execution.
What Is It
The ProSolution WP Client plugin for WordPress fails to properly validate file paths in its proSol_fileDeleteProcess function. The result is CWE-22 (path traversal) leading to arbitrary file deletion.
Exploitation is a two-step sequence. An attacker first calls the proSol_fileUploadModalProcess handler to poison their own session with a path-traversal key, then calls proSol_fileDeleteProcess passing that key as the filename parameter. Both steps require only the publicly exposed frontend nonce; no account, no privileges, no user interaction.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, network-reachable, low complexity, no privileges required, no user interaction, with high integrity and availability impact. The exploitability subscore is a maximum 3.9.
Arbitrary file deletion is not merely destructive. Deleting the right file, wp-config.php being the canonical example, may escalate to remote code execution on the affected host, since a WordPress install without its config file can fall back into a setup state an attacker may be able to drive.
The CISA Known Exploited Vulnerabilities catalog does not list this CVE, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: prosolution
- Product: ProSolution WP Client (WordPress plugin)
- Affected versions: all versions up to and including 2.0.8
Patch Status
The NVD record was published 2026-08-16 with a status of Received, and no fixed version is stated in the supplied data. A WordPress.org plugin changeset (3634993) is referenced alongside the vulnerable code locations, indicating upstream code movement, but the supplied material does not identify a patched release. Operators running 2.0.8 or earlier should treat the plugin as vulnerable and consider deactivating and removing it until a confirmed fixed version is available.
Sources
- NVD, CVE-2026-14524: https://nvd.nist.gov/vuln/detail/CVE-2026-14524
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9698f0-b228-4f4e-838b-c0c0a193d675?source=cve
- WordPress Plugin Trac,
class-prosolwpclient.phpL260: https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.3/includes/class-prosolwpclient.php#L260 - WordPress Plugin Trac,
class-prosolwpclient-public.phpL1135: https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.3/public/class-prosolwpclient-public.php#L1135 - WordPress Plugin Trac,
class-prosolwpclient-public.phpL1256: https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.3/public/class-prosolwpclient-public.php#L1256 - WordPress Plugin Trac; changeset 3634993: https://plugins.trac.wordpress.org/changeset?reponame=&old=3634993%40prosolution-wp-client&new=3634993%40prosolution-wp-client