CVE-2022-0707 - Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

Back Back to CVE browser

MEDIUM

Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

Published Apr 18, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.48%

Description

The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

Affected products

Vendor n/a Product Easy Digital Downloads – Simple eCommerce for Selling Digital Files Default
n/a
- Version
  2.11.6
  Status
  affected
  Constraints
  <2.11.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Easy Digital Downloads – Simple eCommerce for Selling Digital Files

n/a

Version	Status	Constraints
2.11.6	affected	<2.11.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15782
Advisory
https://plugins.trac.wordpress.org/changeset/2697388
x_refsource_CONFIRMPatchThird Party Advisory
https://wpscan.com/vulnerability/50680797-61e4-4737-898f-e5b394d89117
x_refsource_MISCExploitPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15782		Advisory
https://plugins.trac.wordpress.org/changeset/2697388		x_refsource_CONFIRMPatchThird Party Advisory
https://wpscan.com/vulnerability/50680797-61e4-4737-898f-e5b394d89117		x_refsource_MISCExploitPatchThird Party Advisory