CVE-2026-16098

Name of the Vulnerable Software and Affected Versions ProSolution WP Client versions prior to 2.0.11

Description An arbitrary file upload issue exists in the proSol handleFileUpload() function. The flaw stems from missing validation of the Content-Disposition header filename, which allows an attacker to override the allow-listed multipart filename before the file is saved. Additionally, a post-save extension check fails to delete the file after it has been written to the system. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution. The nonce required to access the upload handler is publicly exposed via wp localize script on any front-end page that renders the job portal shortcode, enabling unauthenticated visitors to bypass the security check.

Recommendations Update to a version newer than 2.0.10. As a temporary workaround, restrict access to the proSol handleFileUpload() function until the update is applied.