CVE-2026-14524

Name of the Vulnerable Software and Affected Versions ProSolution WP Client versions prior to 2.0.9

Description Insufficient file path validation in the proSol fileDeleteProcess() function allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as wp-config.php, are removed. Exploitation involves a two-step process: first, calling the proSol fileUploadModalProcess handler to poison the session with a path-traversal key, and second, calling proSol fileDeleteProcess() using that key as the filename parameter. Both actions require a publicly exposed frontend nonce.

Recommendations Update ProSolution WP Client to version 2.0.9 or later. As a temporary mitigation, restrict access to the proSol fileDeleteProcess() function.