Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.5%
exploitation probability
0.5%top 62% of all CVEs
observed exploitation
nono source reports it
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack