CVE-2022-0707

Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

Affected

Easy Digital Downloads – Simple eCommerce for Selling Digital Files

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.48% chance of exploitation in the next 30 days, 40th percentile

Published

2022-04-18

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/50680797-61e4-4737-898f-e5b394d89117

Security advisories

• https://plugins.trac.wordpress.org/changeset/2697388

References

• CVE Record
• NVD entry