CVE-2024-8425: WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload
The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this may have been patched on an older version than 2.9.2, however, we do not have access to older versions of the software to confirm when the patch was added. The only patched version we have confirmed is 2.9.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8425?
CVE-2024-8425 is considered a high severity vulnerability due to potential arbitrary file uploads.
How do I fix CVE-2024-8425?
To fix CVE-2024-8425, update the WooCommerce Ultimate Gift Card plugin to version 2.6.1 or later.
What versions are affected by CVE-2024-8425?
All versions of the WooCommerce Ultimate Gift Card plugin up to and including 2.6.0 are affected by CVE-2024-8425.
What are the consequences of exploiting CVE-2024-8425?
Exploiting CVE-2024-8425 allows attackers to upload arbitrary files, which can lead to remote code execution or data leakage.
Is there a workaround for CVE-2024-8425 if I can't update immediately?
A possible workaround for CVE-2024-8425 is to disable the plugin until it can be updated to a safe version.