The ProSolution WP Client plugin for WordPress contains an arbitrary file upload flaw caused by missing validation of the attacker‑controlled Content‑Disposition header filename. The filename supplied in this header overrides the allow‑listed multipart filename before the file is written, and a post‑save extension check fails to delete the file when the extension is not permitted. As a result, unauthenticated attackers can upload executable files, leading to potential remote code execution. The nonce required to access the upload handler is publicly exposed via wp_localize_script on any front‑end page that renders the job portal shortcode, allowing visitors to obtain a valid nonce and bypass the authentication check entirely. The weakness is a classic file‑upload under‑validation (CWE‑434).

All installations of ProSolution WP Client up to and including version 2.0.10 on WordPress sites are vulnerable. The issue exists in the proSol_handleFileUpload function across all affected releases.

The CVSS base score of 9.8 indicates critical severity, and although the EPSS score is not provided, the lack of an EPSS value does not diminish the high risk. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by crafting an HTTP request that includes a malicious Content‑Disposition header, injecting code, and then triggering the upload via the exposed nonce. Successful exploitation would allow the attacker to write and execute files on the target web server, compromising confidentiality, integrity, and availability of the entire website.