CVE-2024-8425

published 2025-02-28

CVE-2024-8425: The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the…

Priority P1 85 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV Initial access

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this may have been patched on an older version than 2.9.2, however, we do not have access to older versions of the software to confirm when the patch was added. The only patched version we have confirmed is 2.9.3.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wp_swings	woocommerce_ultimate_gift_card	<= 2.9.2	—
wpswings	woocommerce_ultimate_gift_card	<= 2.6.0	—

Detection & IOCs extracted from sources · hover to see the quote

url /wp-admin/admin-ajax.php?action=mwb_wgm_preview_mail↗

path /wp-content/uploads/mwb_browse/↗

path /wp-content/plugins/woocommerce-ultimate-gift-card↗

command action=mwb_wgm_preview_mail↗

• → Detect unauthenticated POST requests to admin-ajax.php with action=mwb_wgm_preview_mail containing a multipart file upload (Content-Type: multipart/form-data) — this is the primary exploit vector for CVE-2024-8425. ↗
• → Monitor for file creation under /wp-content/uploads/mwb_browse/ — uploaded files (including arbitrary/PHP files) are stored here and are directly web-accessible, enabling RCE. ↗
• → The exploit response body contains a pattern matching the uploaded filename and message in the form 'message&name=filename' — look for this pattern in HTTP responses to confirm successful upload. ↗
• → The multipart upload uses Content-Type: image/jpeg for the file part regardless of actual file content — detect mismatched Content-Type vs. file extension (e.g., .php with image/jpeg) in uploads to this endpoint. ↗
• → The vulnerable functions are 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' — monitor AJAX actions for both in server-side logs for unauthenticated callers. ↗

• · The patched version confirmed by Wordfence is 2.9.3, but the patch may have been introduced in an earlier version between 2.6.0 and 2.9.3 — do not assume all versions between 2.6.0 and 2.9.2 are vulnerable without further verification. ↗
• · The Nuclei template targets versions up to 2.6.0 while the NVD advisory covers up to 2.9.2 — detection rules should account for the broader affected range (≤2.9.2) rather than only ≤2.6.0. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434