Wp Live Chat Support Pro Vulnerabilities

[en] The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and pr...

Affected:

up to 8.0.32

Fixed in:

8.0.32

Disclosed:

Jun 3, 2019

CVE-2019-11185 on NVD →

The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepend...

CVSS:

9.8

Affected:

up to 8.0.26

Fixed in:

8.0.27

Disclosed:

May 7, 2019

CVE-2019-11185 on NVD →

The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.

CVSS:

9.8

Affected:

up to 8.0.06

Fixed in:

8.0.07

Disclosed:

Mar 11, 2019

CVE-2018-12426 on NVD →

[en] The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.

Affected:

up to 8.0.0.7

Fixed in:

8.0.0.7

Disclosed:

Jul 2, 2018

CVE-2018-12426 on NVD →