Code execution via case-mismatched plugin path

Path traversal in WPS Office for Windows 12.2.0.13110 through 12.2.0.17114 allows attackers to execute code via a crafted hyperlink. promecefpluginhost.exe rejects parameter names with a case-sensitive comparison, but ksojscore.dll later resolves CefPluginPathU8 case-insensitively and loads libcef.dll from the attacker-controlled path without validating its signature. Execution requires a user to click the link and, for the demonstrated path, access to an attacker-controlled library named libcef.dll on a local-network share.