CVE-2026-6555: ProSolution WP Client RCE Vulnerability

CVE-2026-6555 Overview

CVE-2026-6555 is an arbitrary file upload vulnerability in the ProSolution WP Client plugin for WordPress, affecting all versions up to and including 2.0.0. The plugin validates only the first file in a multi-file upload array against extension and MIME type restrictions, while processing all subsequent files without checks. Unauthenticated attackers can leverage this validation mismatch to upload malicious PHP files to a web-accessible directory and achieve remote code execution. The flaw is categorized under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Unauthenticated remote attackers can upload arbitrary PHP files and execute code on the underlying server, leading to full WordPress site compromise.

Affected Products

• ProSolution WP Client plugin for WordPress, versions up to and including 2.0.0
• WordPress sites with the plugin installed and activated
• Web servers hosting affected WordPress instances

Discovery Timeline

• 2026-05-20 - CVE-2026-6555 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-6555

Vulnerability Analysis

The ProSolution WP Client plugin exposes an upload endpoint that accepts multi-file POST requests. The upload handler iterates over the submitted file array but only applies extension and MIME type validation to the first element. All remaining files bypass validation entirely and are written to a directory accessible from the web root.

An unauthenticated attacker submits a benign file (such as a JPEG image) as the first array entry to satisfy the validator. The attacker then appends a PHP payload as a subsequent entry, which the handler writes to disk without inspection. Requesting the uploaded PHP file through the web server triggers code execution under the web server account.

The vulnerability requires no authentication, no user interaction, and no special privileges. Exploitation yields direct remote code execution, allowing attackers to install web shells, exfiltrate database contents, and pivot into the underlying host.

Root Cause

The root cause is an array validation mismatch in the upload handler logic. The validator inspects $_FILES[0] while the file processing loop iterates over the full $_FILES array. This logic divergence breaks the security assumption that all uploaded files share the same validation outcome. Relevant code paths are documented in the plugin's UploadHandler.php at line 1345 and the public class handler at line 998.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker crafts a multipart POST request containing at least two files. The first file uses a permitted extension such as .jpg with a matching MIME type. The second file uses a .php extension containing the attacker payload. After upload, the attacker browses to the file's predictable path under the plugin's upload directory to invoke the payload.

// Conceptual exploitation flow - no verified PoC code published
// Step 1: Multipart POST with files[0]=valid.jpg, files[1]=shell.php
// Step 2: Server validates files[0], processes both files
// Step 3: Attacker requests /wp-content/uploads/<path>/shell.php
// Step 4: PHP interpreter executes payload, returning attacker output

Detection Methods for CVE-2026-6555

Indicators of Compromise

• Unexpected .php, .phtml, or .phar files appearing inside the ProSolution WP Client upload directory under wp-content
• Multipart POST requests targeting the plugin upload endpoint that contain more than one file part
• Outbound connections from the web server process to unfamiliar IP addresses following an upload event
• New WordPress administrator accounts or modified wp-config.php timestamps shortly after suspicious uploads

Detection Strategies

• Inspect web server access logs for POST requests to ProSolution upload routes followed by GET requests to .php files under wp-content/uploads
• Run integrity monitoring across the WordPress document root to flag newly created executable script files
• Alert on PHP processes spawning shell utilities such as sh, bash, curl, wget, or python from the web server user context

Monitoring Recommendations

• Forward WordPress access and error logs to a centralized SIEM for correlation with file system changes
• Monitor for the creation of files with double extensions or mismatched MIME content within plugin upload directories
• Track outbound network connections from the web server to detect command-and-control callbacks from uploaded web shells

How to Mitigate CVE-2026-6555

Immediate Actions Required

• Deactivate and remove the ProSolution WP Client plugin until a patched version is available from the vendor
• Audit the WordPress wp-content/uploads directory for unauthorized PHP files and remove any identified web shells
• Rotate WordPress administrator credentials, database passwords, and any API keys stored in wp-config.php if compromise is suspected

Patch Information

No patched version is referenced in the available advisory data. Versions up to and including 2.0.0 remain vulnerable. Monitor the Wordfence vulnerability report and the official plugin repository for updates and apply the fixed release as soon as it is published.

Workarounds

• Block requests to the plugin's upload endpoints at the web application firewall layer until a patch is applied
• Disable PHP execution within wp-content/uploads using web server configuration to neutralize uploaded payloads
• Restrict access to WordPress administration and plugin endpoints by source IP where operationally feasible

# Apache: deny PHP execution within the uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php\d*)$">
    Require all denied
</FilesMatch>

# Nginx: equivalent location block in the site configuration
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php\d*)$ {
    deny all;
    return 403;
}