WordPress Plugin Vulnerabilities

SupportCandy <= 2.0.0 - Arbitrary File Upload

Description

The SupportCandy WordPress plugin was affected by an Arbitrary File Upload security vulnerability.

Affects Plugins

Plugin icon
supportcandy
Fixed in 2.0.1

References

CVE
CVE-2019-11223
URL
https://cert.kalasag.com.ph/news/research/vulnerable-wordpress-plugin-lets-you-take-over-websites/
URL
https://github.com/AngelCtulhu/CVE-2019-11223

Miscellaneous

Original Researcher
Christian Angel - KALASAG CERT
Verified
No
WPVDB ID
a8bebdac-9b9b-4fbd-ba3d-c1db43104476

Timeline

Publicly Published
2019-04-17 (about 4 years ago)
Added
2019-08-01 (about 4 years ago)
Last Updated
2020-09-22 (about 3 years ago)

Other

Published
Title
Published
2014-08-01
Title
EditorMonkey - (FCKeditor) Arbitrary File Upload
Published
2017-03-07
Title
Webapp builder 2.0 - Unauthenticated File Upload
Published
2023-11-06
Title
Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload
Published
2014-08-01
Title
Asset Manager - upload.php Arbitrary Code Execution
Published
2013-11-02
Title
Chameleon - Arbitrary File Upload