WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload
85Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 4.0%
de la publicación al arma50 días
Publicada en NVD28 feb
1ª PoC+50d
VulnCheck27 feb
probabilidad de explotación
4.0%top 10% de las CVE
explotación observada
síVulnCheck
2 exploit(s) público(s)
The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this may have been patched on an older version than 2.9.2, however, we do not have access to older versions of the software to confirm when the patch was added. The only patched version we have confirmed is 2.9.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
WP Swings · WooCommerce Ultimate Gift CardPoCs públicas encontradas — 2
githubgithub.com/KTN1990/CVE-2024-8425★ 2vulncheckvulncheck.com/xdb/f19c8df9e026no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.