Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in the ProSolution WP Client plugin for WordPress. An unauthenticated attacker can upload and execute arbitrary files, potentially leading to remote code execution. The exploit is accessible without authentication on any front-end page using the job portal shortcode.
- Unauthenticated file upload allows remote code execution.
- Affects WordPress job portal plugins, exposed externally.
- Confirm relevance and exposure for WordPress job portals.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by interacting with a WordPress site that uses the ProSolution WP Client plugin, specifically when the job portal shortcode is present on a front-end page. The attacker can obtain a valid security token, which is publicly exposed, to bypass authentication checks. By crafting a malicious file upload request that manipulates the filename in the Content-Disposition header, the attacker can trick the plugin into saving an executable file. This can lead to an attacker executing arbitrary code on the server.
- Attacker needs public site access.
- Triggered by manipulating file upload.
- Risk of remote code execution.
Live Threat
Current exploitation, exposure, and threat context
Unauthenticated attackers could upload and execute arbitrary files on a WordPress site, potentially leading to remote code execution. This is possible because the ProSolution WP Client plugin fails to properly validate filenames during file uploads, allowing an attacker to bypass security checks and upload malicious executable files.
- Website files and code could be compromised.
- Attackers could upload executable files remotely.
- Full server compromise or data theft may occur.
Operational Fix
Recommended remediation, mitigation, and detection steps
Determine ownership of the ProSolution WP Client plugin and associated WordPress sites. The first step is to locate all instances of this plugin, assess their exposure to external access, and identify their business criticality and accountable owners to prioritize remediation efforts.
- Identify plugin owners and assess exposure.
- Verify plugin location and business criticality.
- Plan risk-based remediation or vendor action.
