CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6.
Explanation of Vulnerability in Simple Terms
Gift Cards For WooCommerce Pro versions up to 4.2.6 allow unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can upload malicious files—including PHP scripts—to gain control of the WordPress installation. No user interaction or authentication is required. This vulnerability affects all installations running the affected versions.
What an attacker can do
Upload arbitrary files, including PHP scripts, to run code on the site and take control of it.
Potential impact on your site
Complete compromise of the WordPress site; attacker can read data, modify content, create admin accounts, or delete the site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
