blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-11185

CRITICAL 9.8 CVSS 3.0
Published
June 3, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-434
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.

Affected WordPress components

  • 3CX Free Live Chat, Calls & Messaging Plugin · wp-live-chat-support
    Confirmed match Active
    Versions not specified
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • 3cx live_chat — Before 8.0.26

References

  • wordpress.org https://wordpress.org/plugins/wp-live-chat-support/#developers Third Party Advisory
  • wp-livechat.com https://wp-livechat.com/ Vendor Advisory
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/9320 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record