A critical flaw in the ProSolution WP Client WordPress plugin allows unauthenticated attackers to upload arbitrary files to affected sites, which may enable remote code execution where the uploaded file is executable and reachable.
What Is It
CVE-2026-16098 is an arbitrary file upload vulnerability (CWE-434) in the ProSolution WP Client plugin for WordPress, reachable through the proSol_handleFileUpload function. The plugin fails to validate the attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filename before the file is written to disk. A post-save extension check exists but does not delete the already-written file, so a malicious upload survives the check.
The nonce normally gating the upload handler provides no protection: it is publicly exposed via wp_localize_script on any front-end page that renders the job portal shortcode, so an unauthenticated visitor can simply read a valid nonce and proceed.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. Because the uploaded file may be executable, successful exploitation makes remote code execution possible, which in practice would mean full compromise of the WordPress site.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the provided source material.
What's Vulnerable
- Vendor: prosolution
- Product: ProSolution WP Client (WordPress plugin)
- Affected versions: all versions up to and including 2.0.10
Sites are exposed if a front-end page renders the job portal shortcode, since that is where the required nonce is leaked.
Patch Status
The supplied NVD record lists the CVE as Received (published 2026-08-16) and does not state a fixed version or specify a required remediation action. A plugin changeset is referenced in the advisory data and is linked below; operators should review it and the Wordfence advisory to confirm current patch availability.