A security flaw tracked as CVE-2026-16098 has been found in the ProSolution WP Client plugin for WordPress, affecting all versions up to and including 2.0.10. This vulnerability allows anyone visiting your site (even if they are not logged into your WordPress dashboard) to upload files to your site without permission.
The issue stems from missing security checks on file upload requests, which lets attackers bypass the plugin's intended restrictions on what types of files can be uploaded. Uploaded files could be set to run code on your web server, which could let attackers take control of your site, access private customer or business data, or use your site for harmful purposes like spreading malware.
The plugin's built-in security check meant to block unapproved uploads is also broken, as the code required to pass this check is publicly visible on any public page that uses the plugin's job portal feature. This means attackers do not need any special access or login credentials to exploit this vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-16098
