External risk intelligence

ProSolution WP Client File Deletion Vulnerability Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-14524

The vulnerability exists in a WordPress plugin. WordPress sites are web applications typically deployed as public-facing services accessible via the internet. Because the vulnerable functions are part of the plugin's public-facing frontend handlers, they are reachable by remote, unauthenticated users.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the ProSolution WP Client WordPress plugin that allows for arbitrary file deletion on the server. Exploitation could potentially lead to remote code execution by deleting critical configuration files. The main concern is confirming relevance and exposure.

Deletes files on website servers.
Affects WordPress sites using a specific plugin.
Confirm if your WordPress sites are affected.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by targeting the ProSolution WP Client plugin on WordPress sites. An attacker would first interact with a file upload feature to manipulate session data, then use this manipulated data to trigger a file deletion function. This process does not require any prior authentication and can lead to severe consequences on the server if a critical file is deleted.

Entry Condition: No authentication required.
Trigger Point: File deletion function with manipulated session data.
Resulting Risk: Arbitrary file deletion, potential code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to delete arbitrary files on a WordPress server, potentially leading to remote code execution if critical files like configuration settings are targeted. This exposure is possible by chaining two specific plugin handlers, both accessible via the public frontend.

Server files could be deleted.
Attackers can delete arbitrary files.
Remote code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the ProSolution WP Client plugin impacts WordPress sites, potentially leading to arbitrary file deletion and remote code execution. Application owners, in coordination with infrastructure and security teams, should first identify all WordPress instances using this plugin, confirm their exposure and criticality, and then plan remediation. Vendor management teams may also be involved if the plugin was acquired through a third party.

Own: Application owners and infrastructure teams.
Verify: Plugin usage and external accessibility.
Act: Coordinate vendor fix or apply compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ProSolution WP Client plugin?

ProSolution WP Client is an add-on for WordPress websites designed to manage client-side interactions. It helps site administrators organize and handle data or documents shared with users, often functioning as a portal for collaborative tasks directly within the WordPress environment.

How does CVE-2026-14524 lead to file deletion?

This vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory (CWE-22). It occurs because the plugin fails to properly validate file paths before processing deletion requests. By bypassing these checks, an attacker can trick the server into deleting files outside of the intended directory, including critical system configuration files.

Do I need to be logged in to trigger this bug?

No. The vulnerability does not require any user credentials or administrative privileges to trigger. It exploits publicly exposed functions within the plugin that are accessible to anyone visiting the website's frontend. Simply having the plugin active and accessible provides the necessary access for an attacker to initiate the attack sequence.

Why is this vulnerability considered a high-priority risk?

According to Halo Surface Signal, this plugin is part of a WordPress site, which is typically deployed as a public-facing web application. Since the vulnerable handlers are reachable by any remote, unauthenticated user over the internet, the barrier to entry is extremely low, making the site highly accessible for potential exploitation.

What is the first step for an administrator?

You should immediately inventory your WordPress environment to identify any installations running the ProSolution WP Client plugin. Once identified, confirm which instances are accessible via the internet and coordinate with your technical team to prioritize removing the plugin or applying any available official updates to mitigate the risk of unauthorized file deletion.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.