---
id: "CVE-2024-7262"
kind: "vulnerability"
aliases: ["CVE-2024-7262"]
title: "Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to\u2026"
severity: "critical"
cvss: 9.3
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "kingsoft wps office", "fixed": ["12.2.0.16412"], "affected": ">= 12.2.0.13110, < 12.2.0.16412", "ecosystem": "vendor"}, {"name": "Kingsoft WPS Office", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "other", "windows", "wps-office"]
not_affected_if: ["wps-office-not-installed"]
published_at: "2024-08-15T15:15:22+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7262", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7262", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to…

Kingsoft WPS Office on Windows has a path traversal flaw in promecefpluginhost.exe that lets an attacker load an arbitrary Windows library. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:kingsoft wps office affected >= 12.2.0.13110, < 12.2.0.16412 fixed 12.2.0.16412
- vendor:Kingsoft WPS Office affected ? fixed ?

## Fix

Apply mitigations per vendor instructions, or stop using WPS Office if mitigations are unavailable (CISA required action). Fixed version: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7262
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-7262

## From the sources

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library.
The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_