CVE-2026-6555: The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array...

Description

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.98%

57.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-434

References

Timeline

Published: May 20, 2026
Last Modified: Jun 23, 2026
Status: Deferred

Frequently Asked Questions

What is CVE-2026-6555?

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.

How severe is CVE-2026-6555?

CVE-2026-6555 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.98% probability of exploitation in the next 30 days.

How do I fix CVE-2026-6555?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.