CVE-2026-14524

The session-poisoning mechanism in CVE-2026-14524 is the vulnerability that matters—not the file deletion itself. When you trace the exploit chain, the attacker doesn't directly pass path traversal to the delete function. They first poison their own session via proSol_fileUploadModalProcess, planting a path-traversal string as a session key, then reference that key in a separate request to proSol_fileDeleteProcess. This two-step structure reveals the developer's implicit operational assumption: these handlers would only be reachable within legitimate admin workflows. The developers treated session state as a proxy for authorized intent, never anticipating that an anonymous user could populate that session with attacker-controlled path-traversal strings at will. The frontend nonce requirement compounds the misunderstanding. What the CVE describes as a 'publicly exposed frontend nonce' provides obscurity, not authentication. WordPress nonces prevent CSRF for authenticated users—they're tied to user identity, not access rights. Exposing them to unauthenticated actors collapses that trust model entirely. The plugin built a gate that opens if you know the gate code, without checking whether you should be at the gate in the first place. The 0.00702 EPSS score for a 9.1 CVSS unauthenticated RCE-capable flaw reflects exploitation friction, not reduced severity. The two-step chaining with session affinity breaks automated scanner logic that drives EPSS scoring—mass scanning tools can't extract the nonce from the DOM, maintain session state across requests, and chain them correctly. This is a targeted-attack vulnerability, not an untargetable one. The session-poisoning primitive also creates cross-operation exposure: once you can populate arbitrary session keys, every subsequent plugin operation that reads from session becomes a potential pivot point. This isn't a novel attack class. Session-poisoning in WordPress AJAX handlers has appeared before—CVE-2019-6712 and CVE-2018-9037 followed identical logic. The pattern of 'populate session with attacker-controlled reference, trigger dependent operation that trusts it' recurs because the WordPress plugin ecosystem systematically trains developers to use session as scratchpad between AJAX handlers without treating it as a trust boundary. The sediment layer is the accumulated debt from plugins built on this pattern that will never receive dedicated CVE treatment. The temporal dimension matters: once this plugin is abandoned—WordPress plugins have a notorious abandonment half-life—the session-poisoning primitive persists in thousands of unmaintained installations indefinitely. Organizations should audit other plugins using similar 'populate session, then reference session key' workflows, particularly those with publicly exposed nonces on AJAX endpoints. The low EPSS score is a scanner limitation, not an exploitation limitation.

Reviewed through automated stages and approved by a human before publication.