The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.6.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
References
| Link | Resource |
|---|---|
| https://codecanyon.net/item/woocommerce-ultimate-gift-card/19191057 | Product |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/6ebffb82-7455-40c9-9ffd-b78e0e73e431?source=cve | Third Party Advisory |
Configurations
History
06 Mar 2025, 16:36
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wpswings:woocommerce_ultimate_gift_card:*:*:*:*:*:wordpress:*:* | |
| First Time |
Wpswings woocommerce Ultimate Gift Card
Wpswings |
|
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/6ebffb82-7455-40c9-9ffd-b78e0e73e431?source=cve - Third Party Advisory | |
| References | () https://codecanyon.net/item/woocommerce-ultimate-gift-card/19191057 - Product |
28 Feb 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-28 09:15
Updated : 2025-03-06 16:36
NVD link : CVE-2024-8425
Mitre link : CVE-2024-8425
JSON object : View
Products Affected
wpswings
- woocommerce_ultimate_gift_card
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type