CVE-2026-16098: Critical Unauthenticated File Upload in ProSolution WP Client — Detection, Hunting, and Remediation Guide

On the surface, this is another WordPress plugin vulnerability — but CVE-2026-16098 is the kind defenders lose sleep over. NVD has published a CVSS 9.8 (Critical), network-exploitable flaw in the ProSolution WP Client plugin for WordPress, affecting all versions up to and including 2.0.10. The vulnerability is an unauthenticated arbitrary file upload in the proSol_handleFileUpload function that can be leveraged to place executable PHP code on the web server — in practical terms, unauthenticated remote code execution and full site compromise.

Two design failures compound to make this exploitable: (1) the plugin trusts an attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filename before the file is written to disk, and (2) a post-save extension check fails to delete the already-written file, meaning the malicious payload persists on the filesystem even when the validation logic "rejects" it. If your organization — or any of your clients — runs WordPress with this plugin, treat this as an emergency change window, not a routine patch cycle.

Technical Analysis

Affected Products and Versions

• Product: ProSolution WP Client plugin for WordPress
• Affected versions: All versions up to and including 2.0.10
• CVE: CVE-2026-16098
• CVSS v3.1: 9.8 (Critical) — network vector, no authentication, no user interaction
• Vulnerable function: proSol_handleFileUpload
• Reference: NVD — CVE-2026-16098

How the Vulnerability Works (Defender's View)

The attack chain is straightforward, which is exactly what makes it dangerous:

1. Unauthenticated request: The attacker reaches the plugin's file upload handler without valid credentials. A nonce is nominally required to reach the upload path, but as we've seen repeatedly in WordPress plugin flaws, nonce checks are frequently exposed to unauthenticated users via publicly reachable AJAX endpoints (admin-ajax.php) or predictable/leaked nonce values. Defenders should assume the endpoint is reachable.
2. Filename override: The multipart upload contains an allow-listed filename that passes the plugin's initial validation. However, the attacker controls the Content-Disposition header filename, which the plugin uses after validation to determine the final on-disk filename. This is the core defect — validation happens against name A, but the file is written as name B.
3. Bypassing the extension check: The plugin performs an extension check after the file has already been saved, and critically, it fails to unlink the file when the check fails. The malicious file (e.g., a .php webshell) remains on disk inside a web-accessible upload directory.
4. Execution: The attacker sends a follow-up GET/POST request to the uploaded file's URL (typically under wp-content/uploads/ or a plugin-specific subdirectory), and the PHP interpreter executes it with the web server's privileges.

From there, the standard post-exploitation playbook follows: webshell deployment (China Chopper-style one-liners, WSO, b374k variants), credential harvesting from wp-config.php (database creds, auth keys/salts), lateral movement to the database, privilege escalation on the host, and persistence via rogue admin users or modified theme/plugin files.

Exploitation Status

At the time of writing, CVE-2026-16098 has been published by NVD with full technical detail on the vulnerable code path — which means any competent attacker can weaponize it within hours. Given the CVSS 9.8 rating, unauthenticated access, and the trivial nature of multipart request manipulation, defenders should operate under the assumption that mass scanning and opportunistic exploitation are either already underway or imminent. WordPress file-upload bugs of this class are historically among the fastest to be added to automated exploitation toolkits and botnet scanners. Check the CISA Known Exploited Vulnerabilities catalog for current KEV status and any associated federal remediation deadline.

Detection & Response

This is a technical threat, and the detections below target the three most reliable observables: (1) anomalous POST requests to the plugin's upload handler, (2) executable files appearing in WordPress upload directories, and (3) the web server process spawning shells or writing PHP files.

Sigma Rules

The first rule targets web server process behavior — php-fpm, apache2, or nginx spawning command interpreters, a hallmark of webshell execution. The second targets executable file creation in WordPress upload paths, which should almost never contain .php files written at runtime.

---
title: Web Server Process Spawning Shell — Possible WordPress Webshell Execution
id: 3f8c2a91-7d4e-4b6a-9c15-2e8f1a6d4b7c
status: experimental
description: Detects PHP-FPM, Apache, or Nginx worker processes spawning command interpreters, consistent with webshell execution following an arbitrary file upload such as CVE-2026-16098 (ProSolution WP Client).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-16098
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php8.1-fpm'
      - '/php8.2-fpm'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate plugin or backup scripts invoking shell commands via PHP exec functions
  - Some page builders and media plugins invoking ImageMagick or ffmpeg wrappers
level: high
---
title: Executable PHP File Created in WordPress Uploads Directory
id: 9b1d4e77-3c52-4f8a-a6d9-5c2e7b1f8a03
status: experimental
description: Detects creation of PHP or other executable files inside WordPress upload directories, a direct indicator of successful arbitrary file upload exploitation such as CVE-2026-16098.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-16098
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/plugins/prosolution-wp-client/'
      - '/wp-content/plugins/prosolution/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.php8'
      - '.phtml'
      - '.phar'
  condition: selection_path and selection_ext
falsepositives:
  - Rare legitimate plugin operations writing index.php placeholder files (typically empty or containing only a silence comment)
level: critical

KQL — Microsoft Sentinel / Defender

The query below hunts web server logs (ingested via CEF/Syslog or the IIS/Apache connectors) for POST requests targeting the ProSolution upload handler and for subsequent requests to .php files under upload paths. Correlate both patterns by client IP for high-fidelity alerting.

// Hunt: ProSolution WP Client upload abuse + webshell access (CVE-2026-16098)
let lookback = 14d;
let UploadRequests =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where RequestMethod =~ "POST"
    | where RequestURL has_any ("proSol_handleFileUpload", "admin-ajax.php", "prosolution", "wp-client")
    | project UploadTime=TimeGenerated, SourceIP, RequestURL, RequestMethod, DeviceName;
let ShellAccess =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where RequestURL has ("/wp-content/uploads/") and RequestURL endswith ".php"
    | project ShellTime=TimeGenerated, SourceIP, ShellURL=RequestURL, DeviceName;
UploadRequests
| join kind=inner ShellAccess on SourceIP
| where ShellTime > UploadTime
| summarize FirstUpload=min(UploadTime), FirstShellAccess=min(ShellTime),
            UploadURLs=make_set(RequestURL), ShellURLs=make_set(ShellURL)
  by SourceIP, DeviceName
| order by FirstUpload asc

If your WordPress hosts send Syslog with file-integrity or auditd data, also hunt for PHP file creation events:

Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has ("wp-content/uploads") and SyslogMessage has_any (".php", ".phtml", ".phar")
| where SyslogMessage has_any ("CREATE", "OPEN", "write", "rename")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact across your Linux web server fleet to identify PHP files in upload directories — including recently modified ones — plus established outbound connections from web server processes, which often indicate a reverse shell or C2 callback from a deployed webshell.

-- Hunt for PHP files in WordPress upload dirs and suspicious web server connections
LET php_files = SELECT FullPath, Mtime, Size
FROM glob(globs=['/var/www/**/wp-content/uploads/**/*.php',
                 '/var/www/**/wp-content/uploads/**/*.phtml',
                 '/srv/www/**/wp-content/uploads/**/*.php',
                 '/home/**/wp-content/uploads/**/*.php'])
WHERE Size > 0

SELECT FullPath, Mtime, Size FROM php_files
UNION ALL
SELECT 'NETCONN: ' + Pname + ' -> ' + Raddress AS FullPath,
       timestamp(epoch=now()) AS Mtime, Pid AS Size
FROM netstat()
WHERE Pname =~ 'php-fpm|apache2|httpd|nginx'
  AND Status =~ 'ESTABLISHED'
  AND Raddress !~ '^(10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|127\\.)'

Remediation & Verification Script

The following Bash script inventories WordPress installations on a host for the vulnerable plugin version, checks upload directories for PHP files (potential webshells), and optionally removes the vulnerable plugin pending a patched release. Run it as root or via your configuration management tooling across all web servers.

#!/bin/bash
# CVE-2026-16098 - ProSolution WP Client audit and containment script
# Run as root on each WordPress host.

set -u
REPORT="/root/cve-2026-16098-audit-$(date +%Y%m%d-%H%M%S).log"
PLUGIN_SLUGS="prosolution-wp-client prosolution wp-client"
WP_ROOTS="/var/www /srv/www /home"

echo "=== CVE-2026-16098 Audit: $(hostname) $(date) ===" | tee "$REPORT"

# 1. Locate WordPress installations and check for the vulnerable plugin
find $WP_ROOTS -maxdepth 6 -type d -name "wp-content" 2>/dev/null | while read -r WPC; do
  SITE="$(dirname "$WPC")"
  for SLUG in $PLUGIN_SLUGS; do
    PLUGIN_DIR="$WPC/plugins/$SLUG"
    if [ -d "$PLUGIN_DIR" ]; then
      VER=$(grep -m1 -oP 'Version:\s*\K[0-9.]+' "$PLUGIN_DIR"/*.php 2>/dev/null | head -1)
      echo "[FOUND] $SITE -> plugin '$SLUG' version '${VER:-unknown}'" | tee -a "$REPORT"
      # Versions <= 2.0.10 are vulnerable - flag for immediate action
      if [ -n "$VER" ] && [ "$(printf '%s\n2.0.10\n' "$VER" | sort -V | head -1)" != "2.0.10" -o "$VER" = "2.0.10" ]; then
        echo "[VULNERABLE] $PLUGIN_DIR is at or below 2.0.10 - PATCH OR REMOVE IMMEDIATELY" | tee -a "$REPORT"
      fi
    fi
  done
done

# 2. Hunt for PHP/executable files in uploads directories (webshell indicator)
echo "--- Scanning uploads for executable files ---" | tee -a "$REPORT"
find $WP_ROOTS -maxdepth 8 -path "*/wp-content/uploads/*" -type f \
  \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" -o -name "*.php[3-8]" \) \
  -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -50 | while read -r _ F; do
    echo "[SUSPICIOUS FILE] $F" | tee -a "$REPORT"
    head -c 300 "$F" | tee -a "$REPORT" >/dev/null
done

# 3. Review web server access logs for exploitation attempts
echo "--- Access log indicators (last 7 days) ---" | tee -a "$REPORT"
for LOG in /var/log/apache2/access.log /var/log/httpd/access_log /var/log/nginx/access.log; do
  [ -f "$LOG" ] || continue
  grep -E "proSol_handleFileUpload|prosolution" "$LOG" | grep "POST" | tail -20 | tee -a "$REPORT"
  grep -E "/wp-content/uploads/.*\.php" "$LOG" | tail -20 | tee -a "$REPORT"
done

# 4. Containment (uncomment to deactivate and remove the plugin fleet-wide)
# find $WP_ROOTS -maxdepth 6 -type d \( -name "prosolution-wp-client" -o -name "prosolution" \) \
#   -path "*/wp-content/plugins/*" -exec mv {} {}.QUARANTINED \;

echo "=== Audit complete. Review $REPORT ==="

Remediation

1. Patch immediately. Upgrade ProSolution WP Client to a version above 2.0.10 as soon as the vendor ships a fixed release. Monitor the plugin's WordPress.org page and the vendor's changelog. Until a patch exists, deactivate and remove the plugin entirely — given unauthenticated RCE is on the table, "we'll patch in the next maintenance window" is not an acceptable risk posture.
2. If the plugin cannot be removed for business reasons, block the upload path at the edge. Add WAF/reverse-proxy rules denying POST requests to admin-ajax.php carrying the proSol_handleFileUpload action and to any plugin-specific upload endpoints from untrusted sources. ModSecurity rule example: block multipart POSTs whose Content-Disposition filename differs from the part body filename parameter — the exact mismatch this CVE abuses.
3. Deny PHP execution in upload directories. This is a durable hardening control that blunts this entire vulnerability class. For Apache, place a .htaccess in wp-content/uploads/ with php_flag engine off and RemoveHandler .php; for Nginx, add a location block returning 403 for ~* \.php$ under /wp-content/uploads/. For PHP-FPM, this won't stop the write, but it stops execution.
4. Assume compromise and hunt retroactively. If the plugin was installed and internet-reachable when the CVE details became public, review access logs for the past 30+ days using the queries above. Look for POSTs to the upload handler followed by GETs to .php files under uploads. If you find suspicious files, treat the host as compromised: preserve forensic images, rotate wp-config.php database credentials and all WordPress salts/keys, audit admin accounts (SELECT * FROM wp_users WHERE user_registered > ...), and rebuild from a known-good backup if webshell presence is confirmed.
5. Validate file permissions and ownership. Ensure the web server user cannot write outside designated upload paths and that upload directories are not executable by the PHP handler (see #3).
6. Add the asset to your attack surface inventory. Many organizations don't know which WordPress sites they own, much less which plugins are installed. This CVE is a forcing function: enumerate all WordPress instances (including marketing microsites, staging environments, and vendor-hosted properties) and establish plugin-level version visibility.
7. Monitor for KEV inclusion. Check the CISA KEV catalog — if CVE-2026-16098 is added, federal agencies face a binding remediation deadline and every private-sector org should treat that date as their own SLA.

Key Takeaways

• CVSS 9.8, unauthenticated, network-exploitable RCE in a WordPress plugin is a drop-everything event. The dual failure (Content-Disposition filename override + no cleanup on failed extension check) makes exploitation reliable.
• The most durable detection is PHP files appearing in wp-content/uploads/ — legitimate WordPress operation virtually never writes executable code there at runtime.
• Edge controls (WAF blocking of the upload action) buy time, but only patching or plugin removal closes the hole.
• Retroactive hunting is non-negotiable. Publication of detailed vulnerability mechanics means the exploitation clock started when NVD published, not when you patched.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub