CVE-2026-14524 is a path traversal vulnerability (CWE-22) in the ProSolution WP Client WordPress plugin, affecting all versions up to 2.0.8. The vulnerability arises from insufficient validation of file paths in the proSol_fileDeleteProcess function, allowing unauthenticated attackers to delete arbitrary files on the server. Exploitation requires first invoking the proSol_fileUploadModalProcess handler to inject a path-traversal key into the attacker's session, then calling proSol_fileDeleteProcess with this key as the filename parameter. Both steps require only the publicly exposed frontend nonce, making the attack feasible without authentication. Deleting critical files like wp-config.php can lead to remote code execution.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin, potentially causing denial of service or enabling remote code execution by removing critical files such as wp-config.php. This compromises the integrity and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity involving the proSol_fileUploadModalProcess and proSol_fileDeleteProcess handlers. Avoid exposing frontend nonces publicly if possible.