Quote:A WordPress plugin vulnerability found in WP Live Chat could allow an attacker to upload arbitrary malicious files to vulnerable systems, according to researchers.
 
WP Live Chat is a plugin for WordPress that equips websites with a small pop-up chat support window that site owners can use to interact with visiting online customers. A previously-discovered critical arbitrary file upload flaw (CVE‐2018‐12426) was patched in the plugin – but researchers on Monday said they were able to bypass that fix in a proof-of-concept attack.
 
“The implemented protections as part of the patch for CVE‐2018‐ 12426 did not fully resolve the issue and the plugin remained vulnerable to unauthenticated arbitrary file uploads,” said Alert Logic in a Monday post. “The bypass was achieved using a non‐blacklisted executable file extension in conjunction with a whitelisted file extension.”

File upload vulnerabilities used against WordPress are prevalent and easy for attackers to exploit. A recent Wordfence report found that file upload flaws are the third most common vulnerability type for WordPress. These types of flaws are where a plugin allows an attacker to upload a malicious file directly which is then executed.