CVE-2024-8425

The vulnerability in the WooCommerce Ultimate Gift Card plugin for WordPress arises from inadequate validation of file types during specific function executions, namely 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data'. This flaw allows unauthenticated users to upload arbitrary files to the server hosting the affected WordPress site. The lack of stringent checks on the file types means that attackers can exploit this weakness to upload malicious scripts or executables, which may lead to remote code execution. Such a scenario poses a significant risk, as it enables attackers to gain unauthorized access to the server, potentially compromising sensitive data or taking control of the entire web application.

Exploitation of this vulnerability can occur through various attack vectors. An attacker could craft a request that includes a malicious file disguised as a legitimate image or document. By leveraging the functions that handle file uploads, they can bypass security measures that typically restrict file types. Once the malicious file is uploaded, the attacker can execute it to run arbitrary code on the server. This could lead to a range of malicious activities, including data theft, website defacement, or the installation of backdoors for persistent access. The ease of exploitation, combined with the high CVSS score of 9.8, indicates that the vulnerability is particularly critical and should be addressed immediately.

The real-world impact of this vulnerability can be severe for businesses relying on the WooCommerce Ultimate Gift Card plugin. If exploited, an attacker could gain access to sensitive customer information, including payment details and personal data, leading to potential financial losses and reputational damage. Furthermore, the presence of malicious code on a server can result in the website being blacklisted by search engines or security services, further harming the business's online presence. The financial implications of a data breach, coupled with the loss of customer trust, can be devastating, making it imperative for organizations to prioritize the remediation of such vulnerabilities.

To detect and mitigate this vulnerability, organizations should implement several strategies. First, regular security audits and vulnerability assessments should be conducted to identify and address weaknesses in their web applications. Employing a web application firewall (WAF) can help filter out malicious requests and provide an additional layer of security against file upload attacks. Additionally, organizations should ensure that they are using the latest version of the WooCommerce Ultimate Gift Card plugin, as updates often include patches for known vulnerabilities. Educating developers on secure coding practices, particularly regarding file uploads and input validation, is also crucial in preventing similar vulnerabilities in the future.

In conclusion, the vulnerability in the WooCommerce Ultimate Gift Card plugin poses a significant threat to the security of WordPress sites utilizing this plugin. The potential for arbitrary file uploads and subsequent remote code execution can lead to severe consequences for businesses, including data breaches and reputational damage. By adopting proactive detection and mitigation strategies, organizations can safeguard their web applications and protect sensitive customer information from malicious actors. Addressing such vulnerabilities is not just a technical necessity but a critical component of maintaining trust and integrity in the digital marketplace.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the WooCommerce Ultimate Gift Card plugin vulnerability, indicating increased attacker interest and activity despite a declining EPSS score. This divergence suggests that while the overall probability of exploitation in the wild may be moderating, threat actors are intensifying targeted efforts, possibly leveraging emerging proof-of-concept exploits circulating on public repositories. For defenders, this signals a heightened need for vigilance as the risk of successful arbitrary file uploads and potential remote code execution remains acute, particularly given the unauthenticated nature of the exploit vector. The evolving exploitation landscape underscores that the threat level remains critical, with adversaries actively probing for vulnerable instances to compromise, thereby sustaining a high operational risk for affected WordPress environments.

Update 2 — June 07, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the WooCommerce Ultimate Gift Card plugin vulnerability, with telemetry indicating a doubling in detection frequency over a short period. This surge coincides with the wider dissemination of new proof-of-concept exploits on public code repositories, which likely lowers the barrier for adversaries to conduct arbitrary file upload attacks. Although the EPSS score has slightly decreased, reflecting a modest reduction in predicted exploit probability, the increased detection activity suggests that threat actors are intensifying reconnaissance and exploitation efforts. For defenders, this divergence between predictive scoring and observed activity underscores the persistent and evolving nature of the threat, emphasizing that the critical risk of remote code execution via unauthenticated vectors remains imminent. Consequently, the threat level should be considered sustained at a critical posture, with heightened vigilance warranted to detect and respond to exploitation attempts leveraging this vulnerability.