CVE-2026-16098 describes an arbitrary file upload vulnerability in the ProSolution WP Client plugin for WordPress versions up to and including 2.0.10. The vulnerability is caused by missing validation of the attacker-controlled Content-Disposition header filename, which overrides the allowed multipart filename before saving the file. Additionally, a post-save extension check fails to delete the already-written file if it is disallowed. The nonce protecting the upload handler is publicly exposed via wp_localize_script on any front-end page rendering the job portal shortcode, enabling unauthenticated attackers to obtain a valid nonce and bypass the upload gate. This combination allows attackers to upload files that may be executable, potentially leading to remote code execution.

An unauthenticated attacker can upload arbitrary files, including executable ones, to the server running the vulnerable ProSolution WP Client plugin. This can lead to remote code execution, full compromise of the affected WordPress site, and potentially further network pivoting or data theft. The vulnerability has a CVSS 3.1 score of 9.8 (critical), reflecting its high impact and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected upload functionality and consider disabling the ProSolution WP Client plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.