CVE-2022-0707CWE-352

CVE-2022-0707: vulnerability in Easy Digital Downloads – Simple eCommerce for…

Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

Published · Updated

Follow this CVE+ Monitor Easy Digital Downloads – Simple eCommerce for Selling Digital Files

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.5%
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack
Affected products
Unknown · Easy Digital Downloads – Simple eCommerce for Selling Digital Files
Related CVEs — Easy Digital Downloads – Simple eCommerce for…

In the same product, most dangerous first.

CVE-2022-0706—Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2022-2387MEDIUMEasy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRFEPSS 0.3%