An unauthenticated arbitrary file upload vulnerability in the ProSolution WP Client plugin allows remote attackers to execute arbitrary code on the underlying WordPress server.

The plugin fails to validate the filename in the Content-Disposition header and performs inadequate extension checking during file uploads. Because the required security nonce is exposed on front-end pages, an unauthenticated attacker can bypass the upload handler's protections to save executable files.

This is a critical vulnerability that allows for full remote code execution on the web server. Successful exploitation could lead to total site takeover, data exfiltration, or the deployment of persistent backdoors, posing a catastrophic risk to the organization.

Immediate Action: Update the ProSolution WP Client plugin to version 2.0.11 immediately.

Proactive Monitoring: Review web server access logs for requests to file paths within the upload directory that contain unexpected file extensions or suspicious script signatures.

Compensating Controls: Use a Web Application Firewall to block requests containing suspicious file upload patterns or attempts to access common web shell locations.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of remote code execution vulnerabilities in WordPress plugins, this update must be prioritized. Administrators should apply version 2.0.11 immediately and verify that no unauthorized files were uploaded to the server prior to the patch.