The ProSolution WP Client plugin contains an arbitrary file upload flaw that only validates the first file in an upload array. All submitted files, including malicious ones, are written to a publicly accessible directory. An attacker can leverage this oversight by uploading a benign file that passes validation first, followed by a PHP script, thereby executing arbitrary code on the server. This flaw directly leads to complete compromise of the WordPress site, granting the attacker full control over files, data, and server configuration.

WordPress sites that have the ProSolution WP Client plugin installed in any version up to and including 2.0.0 are affected. The vulnerability exists within the plugin's UploadHandler and public class components, exposing the upload endpoint to unauthenticated traffic. Users running earlier or later releases of the plugin are not impacted.

The CVSS score of 9.8 demonstrates a critical severity. Because the attack requires only an unauthenticated POST request to the upload endpoint, the risk is high, especially on publicly accessible WordPress installations. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the lack of KEV listing does not diminish the potential for rapid exploitation in real-world scenarios. Unauthenticated upload is the likely attack vector, with the attacker acting as any visitor to the site. The use of only the first file for validation indicates a clear mismatch in input checking, a classic form of CWE-434.