ProSolution WP Client Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability in the ProSolution WP Client plugin for WordPress, present in all versions through 1.9.9, allows for arbitrary file uploads. This issue arises from inadequate file type validation in the 'proSol_fileUploadProcess' function. As a result, unauthenticated attackers can upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could result in unauthorized file uploads, with the potential for remote code execution on the server.

Reproduction

To reproduce this vulnerability, upload a file through the 'proSol_fileUploadProcess' function without proper file type validation. This can be done by bypassing the whitelisted file extensions and mimetypes.

Remediation

Users are advised to update the ProSolution WP Client plugin to version 2.0.0 or later.