CVE-2021-3120

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must be able to place a valid Gift Card product into the shopping cart. An uploaded file is placed at a predetermined path on the web server with a user-specified filename and extension. This occurs because the ywgc-upload-picture parameter can have a .php value even though the intention was to only allow uploads of Gift Card images.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Feb 22, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-312007.2Common Utilities Remote Code Execution VulnerabilityCVE-2021-312015.2Microsoft Enhanced Cryptographic Provider Elevation of Privilege VulnerabilityCVE-2021-312047.3.NET and Visual Studio Elevation of Privilege VulnerabilityCVE-2021-312056.5Windows SMB Client Security Feature Bypass VulnerabilityCVE-2021-312067.6Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-312076.6Microsoft Exchange Server Security Feature Bypass VulnerabilityCVE-2021-312087.8Windows Container Manager Service Elevation of Privilege VulnerabilityCVE-2021-312096.5Microsoft Exchange Server Spoofing VulnerabilityCVE-2021-31218.6An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut CVE-2021-312117.8Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-312137.8Visual Studio Code Remote Containers Extension Remote Code Execution VulnerabilityCVE-2021-312147.8Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-3120: Critical severity, CVSS 9.8 | Vulnix