PT-2025-9074 · WordPress · Woocommerce Ultimate Gift Card

Tonn

·

Published

2025-02-28

·

Updated

2025-08-27

·

CVE-2024-8425

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WooCommerce Ultimate Gift Card plugin for WordPress versions up to, and including, 2.6.0
Description The issue is related to insufficient file type validation in the mwb wgm preview mail and mwb wgm woocommerce add cart item data functions, allowing unauthenticated attackers to upload arbitrary files on the affected site's server. This could potentially lead to remote code execution.
Recommendations For versions up to, and including, 2.6.0, update to a version that includes a fix for the insufficient file type validation issue. As a temporary workaround, consider disabling the mwb wgm preview mail and mwb wgm woocommerce add cart item data functions until a patch is available. Restrict access to file upload functionality to minimize the risk of exploitation.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-8425

Affected Products

Woocommerce Ultimate Gift Card