CVE-2022-2387mediumCWE-352

CVE-2022-2387: medium-severity vulnerability in Easy Digital Downloads – Simple eCommerce for…

Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF

Published · Updated

Follow this CVE+ Monitor Easy Digital Downloads – Simple eCommerce for Selling Digital Files

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.3%
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
Unknown · Easy Digital Downloads – Simple eCommerce for Selling Digital Files
Related CVEs — Easy Digital Downloads – Simple eCommerce for…

In the same product, most dangerous first.

CVE-2022-0706—Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2022-0707—Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRFEPSS 0.5%