Arbitrary File Deletion in ProSolution WP Client Plugin

The ProSolution WP Client plugin for WordPress versions 2.0.8 and earlier contains a critical security vulnerability, CVE-2026-14524. The flaw exists within the proSol_fileDeleteProcess function, which lacks adequate path validation. This oversight allows an unauthenticated attacker to manipulate file deletion requests to remove arbitrary files from the web server's filesystem.

The vulnerability is chained by first interacting with the proSol_fileUploadModalProcess handler to inject a path-traversal payload into the user session. Once the session is poisoned using the plugin's frontend nonce, an attacker can trigger the proSol_fileDeleteProcess function to target specific files. Successful deletion of critical files like wp-config.php can force a WordPress site into a re-installation state or trigger other application behaviors that lead to remote code execution. Defenders should prioritize updating the plugin to the latest patched version or disabling the component if an immediate update is not feasible.

Impact

Successful exploitation of CVE-2026-14524 allows for the deletion of any file accessible to the web server process. In a WordPress environment, this typically results in the removal of configuration files like wp-config.php, which can lead to site takeover, loss of data integrity, and remote code execution if the application is subsequently re-installed or misconfigured by the attacker.

Recommendation

• Update the ProSolution WP Client plugin to the latest available version containing a patch for CVE-2026-14524.
• Monitor web server access logs for anomalous POST requests directed at plugin handlers proSol_fileUploadModalProcess and proSol_fileDeleteProcess.
• Audit filesystem integrity for critical WordPress configuration files like wp-config.php, particularly on internet-facing WordPress instances.
• Use the webserver log source to identify and block unauthorized access attempts if patching is delayed.