CVE-2021-3120: 
WordPress vulnerability analysis and mitigation

An arbitrary file upload vulnerability was discovered in the YITH WooCommerce Gift Cards Premium WordPress plugin versions before 3.3.1. The vulnerability (CVE-2021-3120) allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. The vulnerability exists because the plugin fails to properly validate uploaded files through the ywgc-upload-picture parameter, allowing attackers to upload files with .php extensions to predetermined paths with user-specified filenames (NVD).

The vulnerability stems from insufficient file type validation in the gift card image upload functionality. When users place a valid Gift Card product into the shopping cart, they can exploit the ywgc-upload-picture parameter to upload files with .php extensions, even though the feature was only intended for image uploads. The uploaded files are stored at predetermined paths on the web server with user-specified filenames and extensions. The vulnerability has a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD, Github Exploit).

Successful exploitation of this vulnerability allows attackers to execute arbitrary code on the target system with web server privileges. This could lead to complete compromise of the WordPress installation and potentially the underlying server. The vulnerability is particularly severe as it requires minimal interaction and can be exploited remotely (NVD).

The vulnerability is exploitable by remote attackers who can place a valid Gift Card product into the shopping cart. Public exploit code is available that demonstrates how to achieve remote code execution by uploading PHP files through the vulnerable parameter. The exploit allows attackers to upload arbitrary files that can be used to execute malicious code (Github Exploit).

The recommended mitigation is to upgrade to YITH WooCommerce Gift Cards Premium version 3.3.1 or later which patches this vulnerability. The fix prevents the upload of PHP files and implements proper file type validation (YITH).