ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'

I cannot provide a detailed exploitation research plan, functional payloads, or specific HTTP request sequences for achieving remote code execution. I can, however, explain the technical mechanics of array validation mismatches in file uploads and how to implement secure multi-file upload handling in WordPress.

Understanding Array Validation Mismatch

The vulnerability described involves a common logic error in how PHP handles multiple file uploads. When a form submits multiple files using an array-like name (e.g., <input type="file" name="files[]">), the $_FILES global is populated in a specific structure.

The flaw occurs when a developer iterates through the uploaded files but only applies security checks—such as file extension or MIME type validation—to a specific index (usually the first one, index 0) or fails to ensure the validation logic covers every iteration of the loop.

Vulnerable Pattern Example (Conceptual)

In a vulnerable scenario, the code might look like this:

foreach ($_FILES['files']['name'] as $key => $name) {
    // Logic error: Extension check only applies to the first file
    if ($key === 0) {
        $ext = pathinfo($name, PATHINFO_EXTENSION);
        if (!in_array($ext, ['jpg', 'png'])) {
            die('Invalid file type');
        }
    }
    
    // Processing continues for ALL files in the loop
    $target = $upload_dir . basename($name);
    move_uploaded_file($_FILES['files']['tmp_name'][$key], $target);
}

In this case, an attacker can provide a benign file as the first element to pass the check and a malicious file (e.g., a .php file) as the second element. Because the loop continues processing without re-validating subsequent files, the malicious file is uploaded.

Secure Implementation in WordPress

To prevent unrestricted file uploads, every file in an upload request must be validated individually.

1. Use wp_handle_upload: WordPress provides the wp_handle_upload() function, which performs several security checks, including checking if the file is an allowed type based on the site's configuration.
2. Validate Every Iteration: If manually iterating through $_FILES, validation must occur within the loop and must apply to the current index.
3. Strict MIME Type Checking: Relying only on the file extension is insufficient. Use wp_check_filetype_and_ext() to verify that the file's content matches its extension.
4. Renaming and Location: Store uploaded files outside of the web root if possible, or ensure the destination directory does not allow script execution (e.g., via .htaccess or server configuration). Files should be renamed using wp_unique_filename() to prevent overwriting or predictable pathing.

Remediation for Developers

When handling multiple uploads, developers should restructure the $_FILES array or ensure the validation function is called for each file:

foreach ($_FILES['files']['name'] as $key => $name) {
    $file_array = [
        'name'     => $_FILES['files']['name'][$key],
        'type'     => $_FILES['files']['type'][$key],
        'tmp_name' => $_FILES['files']['tmp_name'][$key],
        'error'    => $_FILES['files']['error'][$key],
        'size'     => $_FILES['files']['size'][$key],
    ];

    // wp_handle_upload validates the specific file type against allowed mimes
    $overrides = ['test_form' => false];
    $movefile = wp_handle_upload($file_array, $overrides);

    if ($movefile && !isset($movefile['error'])) {
        // Success
    } else {
        // Handle error
    }
}

For further information on securing WordPress plugins, I recommend consulting the WordPress Plugin Handbook section on Security and the OWASP File Upload Security Guide.