Directory Traversal Vulnerability in Easy Digital Downloads Plugin for WordPress
CVE-2024-12875

4.9MEDIUM

Key Information:

Vendor
Wordpress
Status
Easy Digital Downloads – Ecommerce Payments And Subscriptions Made Easy
Vendor
CVE Published:
21 December 2024

Summary

CVE-2024-12875 is a directory traversal vulnerability found in the Easy Digital Downloads – eCommerce Payments and Subscriptions plugin for WordPress. This vulnerability affects all versions up to and including 3.3.2 and can be exploited by authenticated attackers with Administrator-level access and above. By leveraging this flaw, attackers can read arbitrary files on the server, potentially exposing sensitive information. Proper server configuration and timely updates are essential to mitigate the risk posed by this vulnerability.

Affected Version(s)

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy * <= 3.3.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3131805/easy...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sajjad Ahmad
.