CVE-2026-2942 affects the ProSolution WP Client plugin for WordPress in all versions up to and including 1.9.9. The vulnerability arises from a lack of file type validation in the 'proSol_fileUploadProcess' function, permitting unauthenticated attackers to upload arbitrary files. This can lead to remote code execution on the server hosting the plugin. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a critical risk with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed by the vendor as of the published date.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server, which may result in remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score and the nature of the vulnerability, the impact is severe for sites using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the ProSolution WP Client plugin if possible, or restrict file upload capabilities through other means such as web application firewalls or server-level restrictions. Monitor vendor channels for updates and apply patches promptly once available.