blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-8425

CRITICAL 9.8 CVSS 3.1
Published
February 28, 2025
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this may have been patched on an older version than 2.9.2, however, we do not have access to older versions of the software to confirm when the patch was added. The only patched version we have confirmed is 2.9.3.

Affected products and versions

  • WP Swings WooCommerce Ultimate Gift Card — Up to and including 2.9.2
  • wpswings woocommerce_ultimate_gift_card — Up to and including 2.6.0

References

  • codecanyon.net https://codecanyon.net/item/woocommerce-ultimate-gift-card/19191057 Product
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/6ebffb82-7455-40c9-9ffd-b78e0e73e431?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record