Unauthenticated code execution via filename override

Arbitrary file upload in ProSolution WP Client through 2.0.10 allows remote attackers to execute code via the public job-portal upload handler. In proSol_handleFileUpload, the plugin trusts an attacker-controlled Content-Disposition filename over the allowlisted multipart name when saving the file, then checks the extension only after the write and fails to remove the already created file. Any page that renders the job portal shortcode exposes a valid nonce through wp_localize_script, so unauthenticated visitors can reach the handler and plant executable files on the server.