CVE-2021-3120: wordpress yith-woocommerce-gift-cards-premium
Vulnerability summary
CVE-2021-3120 is a high (CVSS 10.0) vulnerability in wordpress yith-woocommerce-gift-cards-premium. EPSS estimates a 36.78% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.3.1.
Timeline
- 22-02-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must be able to place a valid Gift Card product into the shopping cart. An uploaded file is placed at a predetermined path on the web server with a user-specified filename and extension. This occurs because the ywgc-upload-picture parameter can have a .php value even though the intention was to only allow uploads of Gift Card images.
CVSS metrics
4 scores · 3 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
36.78%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 36.78% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundYith Giftdrop
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Wordpress1 product
- yith-woocommerce-gift-cards-premium< 3.3.1
Yithemes1 product
- yith_woocommerce_gift_cards< 3.3.1
2 vendors · 2 products