A critical path traversal vulnerability in the ProSolution WP Client plugin allows unauthenticated attackers to delete arbitrary files, posing a risk of full system compromise.

Insufficient validation in the proSol_fileDeleteProcess function allows an unauthenticated attacker to manipulate file paths. By poisoning a session with a path traversal key, an attacker can delete sensitive files like wp-config.php, which can lead to remote code execution.

With a CVSS score of 9.1, this vulnerability presents a severe risk of data loss and service interruption. The ability to delete arbitrary files allows an attacker to disable security mechanisms or force a site reset, leading to total loss of control over the application.

Immediate Action: Update the ProSolution WP Client plugin to version 2.0.9 or later to resolve the path traversal flaw.

Proactive Monitoring: Inspect server logs for requests involving the proSol_fileUploadModalProcess or proSol_fileDeleteProcess functions that contain suspicious directory traversal patterns.

Compensating Controls: Deploy a Web Application Firewall to inspect and block requests that attempt to pass directory traversal sequences through the plugin's filename parameters.

Public Exploit Available: Unknown

Administrators should treat this as a high-priority update. Updating to version 2.0.9 is the only effective way to mitigate the risk of arbitrary file deletion and potential server compromise.