CVE-2019-11185

The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file...

CVE-2019-11185

The CVE-2019-11185 entry affects the WordPress WP Live Chat Support Pro plugin up to version 8.0.26. The vulnerability is an arbitrary file upload in the REST API endpoint remote_upload, caused by an incomplete patch for CVE-2018-12426. An unauthenticated attacker can bypass MIME checks by using ...

CVE-2018-12426

The CVE-2018-12426 entry concerns the WP Live Chat Support Pro WordPress plugin prior to version 8.0.07, vulnerable to unauthenticated remote code execution via crafted file uploads. Root cause per connected docs: the plugin validates file types on the client side and uses MIME checks that can be...