Two Critical WordPress Plugin Flaws: File Upload in ProSolution and Admin Takeover in Frontend Admin

Why these two flaws require separate checks

Two WordPress plugin vulnerabilities published on August 15, 2026 break different trust boundaries. ProSolution WP Client can accept an attacker-controlled filename during upload processing, while Frontend Admin by DynamiApps can skip an authorization check when a crafted non-numeric user identifier reaches a public AJAX path. Each flaw stands on its own, so a site is exposed if it runs either affected plugin under the relevant configuration.

CVE-2026-16098: ProSolution WP Client file upload

CVE-2026-16098 affects ProSolution WP Client through version 2.0.10. Wordfence reports that the proSol_handleFileUpload function validates an allow-listed multipart filename, but an attacker-controlled Content-Disposition filename can replace it before the file is written. A later extension check does not remove the file that is already on disk. The job-portal shortcode also exposes the required nonce to visitors, so that nonce does not provide an authorization boundary for the upload handler.

An unauthenticated attacker may therefore upload a file that can be executable under the server's storage and web-server configuration. Successful exploitation can lead to remote code execution and broader modification of the WordPress installation. Wordfence lists version 2.0.11 as the patched release.

CVE-2026-18432: Frontend Admin privilege escalation

CVE-2026-18432 affects Frontend Admin by DynamiApps through version 3.29.9. The vulnerable logic performs the edit_user capability check only when the supplied user identifier is numeric. A crafted item_id value can make the check disappear, while WordPress later coerces the value to integer 1. With a server-signed object payload, an attacker can change the password or email address of the default administrator account.

Unauthenticated exploitation requires a public frontend user form. In other configurations, a subscriber-level account is sufficient. Administrators should therefore review both the installed version and the exposure of frontend user forms and their AJAX handlers. Wordfence lists version 3.29.10 as the patched release.

Operational review

1. Inventory both plugins across production, staging, and restored instances.
2. Identify public ProSolution job-portal shortcodes and Frontend Admin user forms.
3. Update ProSolution WP Client to 2.0.11 or later and Frontend Admin to 3.29.10 or later.
4. Retest legitimate features and confirm unauthorized upload or account-change requests are rejected.
5. Review new executable files, administrator-account changes, and relevant web and WordPress logs.

Patching removes the known vulnerable code path but does not establish whether the path was used before the update. Sites that exposed affected versions should preserve logs and review file and account changes before deleting suspicious artifacts. Unexpected PHP files or administrator changes should be investigated with their timestamps and request context intact.

Verification basis

This article was verified against the Wordfence Intelligence records at 16:55 KST on August 17, 2026. Confirm the latest supported plugin release and compatibility requirements in your own change-management process before deployment.