CVE-2022-2387 - Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF

Back Back to CVE browser

MEDIUM

Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF

Published Nov 7, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.30%

Description

The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack

Affected products

Vendor n/a Product Easy Digital Downloads – Simple eCommerce for Selling Digital Files Default
n/a
- Version
  3.0
  Status
  affected
  Constraints
  <3.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Easy Digital Downloads – Simple eCommerce for Selling Digital Files

n/a

Version	Status	Constraints
3.0	affected	<3.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34653
Advisory
https://wpscan.com/vulnerability/db3c3c78-1724-4791-9ab6-ebb2e8a4c8b8
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34653		Advisory
https://wpscan.com/vulnerability/db3c3c78-1724-4791-9ab6-ebb2e8a4c8b8		ExploitThird Party Advisory