CVE-2024-8425 is a critical (CVSS 9.8) unauthenticated arbitrary file upload in the WooCommerce Ultimate Gift Card plugin for WordPress, in all versions up to and including 2.9.2. Insufficient file type checks can lead to remote code execution. The only patched version confirmed in the record is 2.9.3, so update to it or later.
What's affected
The record covers the WooCommerce Ultimate Gift Card plugin from WP Swings, in all versions up to and including 2.9.2. The vulnerable functions are named in the record as mwb_wgm_preview_mail and mwb_wgm_woocommerce_add_cart_item_data, and both fail to validate file types properly.
The record adds a careful note. The flaw may have been patched in a release older than 2.9.2, but the researchers did not have access to older versions to confirm. The only patched version they confirmed is 2.9.3. So treat 2.9.3 as the safe target, and treat earlier versions as exposed unless the vendor says otherwise.
Unauthenticated means that no login is needed. A visitor to a store with this plugin active may be able to put a file of their choosing on the server, and the record says that may make remote code execution possible.
How to check if you're exposed
Look at the plugin version on each WordPress site you manage.
- In the WordPress admin, open Plugins and find WooCommerce Ultimate Gift Card. The version appears under the name.
- With command line access and WP-CLI, run the following from the site directory.
wp plugin list
wp plugin get woocommerce-ultimate-gift-card --field=version
The plugin slug may differ on your install, so use the first command to find it. If the plugin came from CodeCanyon rather than the WordPress directory, updates may not arrive through the normal channel, so check your purchase page.
- Look in the uploads folder for files that should not be there, such as PHP files, and review recent changes in the web root.
What to do now
- Find every WordPress site that has the Ultimate Gift Card plugin.
- Update to version 2.9.3 or later from the vendor.
- Scan the uploads folder and the web root for unexpected PHP or script files.
- If you find an unexpected file, treat the site as compromised: restore from a clean backup and rotate WordPress, database and hosting passwords.
- Block PHP execution in the uploads directory at the web server level.
- Deactivate the plugin until it is updated if you cannot patch today.
Why it matters
File upload bugs happen when code accepts a file and trusts its name or declared type. If the server stores the file where the web server can run it, the upload becomes code on the server.
The class is unrestricted upload of a dangerous file type. A good upload handler checks the real content type against an allowlist, renames the file, and stores it where scripts do not run. WordPress plugin ecosystems add a wrinkle: many commercial plugins are sold outside the plugin directory, so patches reach site owners more slowly, which makes a version check worth doing by hand.
The weakness class is CWE-434: Unrestricted Upload of File with Dangerous Type. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version is safe?
The record says the only patched version confirmed is 2.9.3.
Do attackers need an account?
No. The record says unauthenticated attackers can upload files.
Sources
Last reviewed: 19 October 2026.
