Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF
CVE-2022-2387

4.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Easy Digital Downloads – Simple Ecommerce For Selling Digital Files
Vendor
CVE Published:
7 November 2022

What is CVE-2022-2387?

The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack

Affected Version(s)

Easy Digital Downloads – Simple eCommerce for Selling Digital Files 3.0

References

https://wpscan.com/vulnerability/db3c3c78-1724-4791-9ab6-...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.