A security flaw has been found in the ProSolution WP Client plugin for WordPress, which impacts every version of the plugin up to and including 2.0.10. This flaw allows unauthenticated attackers (people who do not have login access to your WordPress dashboard) to upload files to your site, even though the plugin is designed to block unapproved uploads.
The flaw works because the plugin does not properly validate the filename included in file upload requests, letting attackers override the plugin's list of allowed file types. The check the plugin runs after a file is saved to catch unapproved files also fails to delete dangerous files that slip through. Additionally, the security token the plugin uses to restrict access to its upload feature is publicly visible on any page of your site that uses the plugin's job portal shortcode, so any visitor to those pages can get a valid token to bypass that restriction entirely.
If an attacker is able to upload an executable file through this flaw, they can run code on your website. This could let them take control of your site, steal visitor or customer data, deface your public pages, or use your site to host malicious content or attack other websites.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-16098
