CVE-2026-2942
The ProSolution WP Client plugin for WordPress contains a flaw that allows users to upload any type of file to a website's server. This happens because the plugin fails to properly check the type of file being uploaded.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running the ProSolution WP Client plugin for WordPress, specifically all versions up to and including 1.9.9.
Real-world impact
An attacker could upload malicious files to your website, which could allow them to take complete control of your server and execute their own code remotely.
Why this severity
This is a critical vulnerability because it can be exploited remotely over the internet without needing any login credentials or user interaction, potentially leading to full system compromise.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 8, 2026 · Apr 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 25, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.