Plugin Vulnerability Could Allow Authenticated Users to Perform Malicious Actions

CVE-2022-2439

What is CVE-2022-2439?

The Easy Digital Downloads plugin for WordPress is exposed to a deserialization vulnerability through the 'upload[file]' parameter. This vulnerability affects versions up to and including 3.3.3, allowing authenticated administrative users to exploit the system by using a PHAR wrapper to deserialize and invoke arbitrary PHP Objects. Such actions can lead to various malicious activities, contingent upon the presence of a suitable PHP Object Pollution (POP) chain. This significant weakness underscores the need for immediate updates and security best practices to mitigate potential misuse.

References