CVE-2026-14524: Critical Unauthenticated File Deletion in ProSolution WP Client

Executive Summary

A critical unauthenticated arbitrary file deletion vulnerability (CVE-2026-14524) has been disclosed in the ProSolution WP Client plugin for WordPress. The flaw carries a CVSS score of 9.1 and allows any unauthenticated attacker to delete arbitrary files on an affected server — including WordPress core files, wp-config.php, or .htaccess — potentially causing complete site outages or enabling secondary attacks.

CVSS Score: 9.1 (Critical)

The vulnerability resides in the proSol_fileDeleteProcess function, which processes file deletion requests without validating the file path or verifying the identity of the requester. All versions up to and including 2.0.8 are affected.

Vulnerability Overview

Affected Versions

Technical Details

The vulnerability exists in the proSol_fileDeleteProcess function of the ProSolution WP Client plugin. This function is accessible to unauthenticated users and lacks:

• File path validation — no check that the path is within a permitted directory
• Authentication check — no nonce or capability verification
• Authorization enforcement — no restriction on which files can be targeted

An attacker can supply a crafted request pointing to any server-readable file, causing the web server process to delete it.

Attack Scenario

1. Attacker identifies WordPress site running ProSolution WP Client <= 2.0.8
2. Attacker crafts HTTP POST request targeting proSol_fileDeleteProcess
3. File path parameter set to target critical file (e.g., wp-config.php)
4. Server deletes the file — no authentication, no logging
5. WordPress enters error state; site may display database credentials in error
6. Attacker pivots to full site takeover or causes permanent outage

High-Value Targets for Exploitation

Remediation

Step 1: Deactivate and Remove the Plugin

Until a patched version is released, the only safe course is to deactivate and uninstall the ProSolution WP Client plugin immediately.

# Via WP-CLI
wp plugin deactivate prosolution-wp-client
wp plugin delete prosolution-wp-client

Or via WordPress admin: Plugins > Installed Plugins > ProSolution WP Client > Deactivate > Delete.

Step 2: Audit Deleted Files

Check your WordPress installation for recently deleted files that may indicate active exploitation:

# Compare current WordPress files against a known-good checksums
wp core verify-checksums
 
# Check for missing wp-config.php
ls -la /path/to/wordpress/wp-config.php
 
# Review web server error logs for deletion-related errors
tail -n 200 /var/log/nginx/error.log | grep -i "No such file"

Step 3: Block Plugin Endpoint at WAF/Reverse Proxy

If immediate removal is not possible, block requests to the vulnerable function:

# Nginx — block requests targeting proSol_fileDeleteProcess
location ~* "proSol_fileDeleteProcess" {
    deny all;
    return 403;
}

Step 4: Check File Integrity

# List recently modified or missing files
find /path/to/wordpress/ -name "*.php" -newer /path/to/wordpress/wp-login.php -type f
 
# Restore WordPress core if files are missing
wp core download --force
wp core update-db

Detection Indicators

Post-Incident Steps

1. Remove the plugin from all affected installations
2. Restore deleted files from a known-good backup
3. Rotate database credentials if wp-config.php was deleted
4. Audit admin accounts for unauthorized additions
5. Deploy a WAF with a rule blocking the vulnerable function
6. Monitor access logs for further exploitation attempts
7. Consider a file integrity monitor (Wordfence, iThemes Security)

References

• NIST NVD — CVE-2026-14524

Related Reading

• WPvivid Backup Plugin Critical RCE (CVE-2026-1357)
• WordPress Modular DS Critical Flaw (CVSS 10.0)