The ProSolution WP Client plugin allows attackers to delete arbitrary files on a WordPress server when the proSol_fileDeleteProcess function fails to validate the file path. By issuing a crafted delete request, an unauthenticated user can remove any file, such as wp-config.php, which can then lead to remote code execution or other compromise. The weakness is a path‑traversal error mapped to CWE‑22, and the loss of integrity and availability may also expose the system to denial‑of‑service attacks.

All installations of the ProSolution WP Client plugin with a version of 2.0.8 or earlier, which runs on WordPress sites. No specific WordPress core version is mentioned, though the plugin’s own code places the vulnerability. The affected vendor is ProSolution, product ProSolution WP Client.

The CVSS score of 9.1 classifies this flaw as critical, and the EPSS score is currently unavailable, yet the absence of a KEV listing does not reduce its potential impact. An attacker only needs to know the public frontend nonce and can perform the exploit remotely without authentication. Once the payload is sent, deleting a sensitive file can directly enable arbitrary code execution. The likely attack vector is via the publicly exposed “proSol_fileUploadModalProcess” API that sets a session key, followed by a call to “proSol_fileDeleteProcess” with a malicious filename. The combination of low effort, lack of authentication, and severe consequences makes the vulnerability highly actionable.