Cross-Site Request Forgery Vulnerability in Easy Digital Downloads Plugin for WordPress
CVE-2025-8102
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 August 2025
What is CVE-2025-8102?
The Easy Digital Downloads plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to carry out Cross-Site Request Forgery (CSRF) attacks. This issue arises from the lack of nonce validation in two critical functions: edd_sendwp_disconnect() and edd_sendwp_remote_install(). By exploiting this vulnerability, attackers can trick site administrators into unknowingly executing malicious actions, which could lead to the unauthorized deactivation or installation of the SendWP plugin.
Affected Version(s)
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy * <= 3.5.0