Woocommerce Ultimate Gift Card
CVE-2024-8425
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 63.0%. WooCommerce gift card plugins are installed on e-commerce sites that process customer payments and store PII. The unauthenticated attack vector through a customer-facing feature maximizes the attack surface. |
| Exploit ScenarioDerived | An attacker interacts with the gift card purchase flow, uploading a PHP webshell as a 'custom gift card image'. The file is saved without type checking. The attacker accesses the uploaded PHP file, gains command execution, and extracts WooCommerce order data including customer addresses, payment information, and order histories. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
The WooCommerce Ultimate Gift Card plugin through version 2.6.0 contains unauthenticated arbitrary file uploads in the mail preview and cart functions. Insufficient file type validation allows attackers to upload PHP webshells through the gift card functionality, achieving remote code execution on e-commerce sites.
Earlier versions of this analysis (1)
Unauthenticated file upload in WooCommerce Ultimate Gift Card plugin enables RCE on WordPress e-commerce sites through gift card features.
RemediationAI
Update to a version beyond 2.6.0. Restrict uploaded file types to images only. Configure the web server to block PHP execution in upload directories. Scan upload directories for PHP files.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The mwb_wgm_preview_mail and mwb_wgm_woocommerce_add_cart_item_data functions process file uploads for gift card customization without proper file type validation. An unauthenticated attacker can upload PHP files through these endpoints, which are stored in web-accessible directories. The uploaded PHP can be executed directly via HTTP.
Know when Woocommerce Ultimate Gift Card gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.6.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Executive ViewAI
Organizations using all face critical risk from CVE-2024-8425, a unrestricted file upload vulnerability rated CVSS 9.8. This could allow attackers to access or modify files outside intended directories, potentially exposing sensitive configuration or credentials. With an EPSS score of 63%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict file upload functionality via WAF; (2) Implement allowlist-based file type validation; (3) Use chroot/containerization to limit filesystem access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB