CVE-2018-12426
9.8
CRITICAL · CVSS 3.0 · EPSS 5.1% (pctl 92)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 5.06% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-434 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-07-02 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| 3cx | live chat |
References
- https://github.com/CodeCabin/wp-live-chat-support/blob/master/readme.txt
- https://github.com/RiieCco/write-ups/tree/master/CVE-2018-12426
- https://wpvulndb.com/vulnerabilities/9697
- https://github.com/CodeCabin/wp-live-chat-support/blob/master/readme.txt
- https://github.com/RiieCco/write-ups/tree/master/CVE-2018-12426
- https://wpvulndb.com/vulnerabilities/9697
→ the Explorer · watch your stack · NVD