CVE-2019-11223

An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.

• CWE-434

• https://cert.kalasag.com.ph/news/research/vulnerable-wordpress-plugin-lets-you-take-over-websites/Exploit, Third Party Advisory
• https://wordpress.org/plugins/supportcandy/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9488
• https://www.pluginvulnerabilities.com/2019/04/05/arbitrary-file-upload-vulnerability-in-supportcandy/Exploit, Third Party Advisory
• https://cert.kalasag.com.ph/news/research/vulnerable-wordpress-plugin-lets-you-take-over-websites/Exploit, Third Party Advisory
• https://wordpress.org/plugins/supportcandy/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9488
• https://www.pluginvulnerabilities.com/2019/04/05/arbitrary-file-upload-vulnerability-in-supportcandy/Exploit, Third Party Advisory

Published

Apr 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11218Improper handling of extra parameters in the AccountControll…
• CVE-2019-11219The algorithm used to generate device IDs (UIDs) for devices…
• CVE-2019-1122A remote code execution vulnerability exists in the way that…
• CVE-2019-11220An authentication flaw in Shenzhen Yunni Technology iLnkP2P …
• CVE-2019-11221GPAC 0.7.1 has a buffer overflow issue in gf_import_message(…
• CVE-2019-11222gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buf…7.8
• CVE-2019-11224HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command …
• CVE-2019-11226CMS Made Simple 2.2.10 has XSS via the m1_name parameter in …
• CVE-2019-11228repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-R…
• CVE-2019-11229models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before…8.8
• CVE-2019-1123A remote code execution vulnerability exists in the way that…
• CVE-2019-11230In Avast Antivirus before 19.4, a local administrator can tr…