An unauthenticated remote code execution vulnerability in the giftware WordPress plugin allows attackers to upload and execute arbitrary files on the server.

The plugin fails to perform adequate file type validation on one of its upload paths. This allows unauthenticated users to upload arbitrary files, including malicious PHP scripts, resulting in remote code execution on the hosting server.

The CVSS score of 9.8 reflects the ease of exploitation and the high impact on confidentiality, integrity, and availability. Successful exploitation grants an attacker full control over the web application, facilitating data exfiltration, malware distribution, or complete server takeover.

Immediate Action: Update the giftware plugin to version 4.2.10 or later immediately.

Proactive Monitoring: Audit the server for any uploaded files in the plugin's upload directories and check for signs of unauthorized access or backdoors.

Compensating Controls: Use a WAF to block unauthorized file uploads and restrict access to the affected directory by disabling direct script execution via server configuration files (such as .htaccess).

Public Exploit Available: Unknown

Due to the critical nature of this vulnerability, immediate remediation is required. If an update cannot be applied immediately, the plugin should be deactivated and removed from the environment to eliminate the attack vector until a patch is deployed.