Skip to content
Sign in
Not rated

CVE-2022-0707 The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment…

Description

The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

Affected products and versions

Product Affected versions Fixed in
Easy Digital Downloads – Simple eCommerce for Selling Digital Files 2.11 earliest → < 2.11.6 2.11.6

Other CVEs of Easy Digital Downloads – Simple eCommerce for Selling Digital Files

The 3 CVEs of Easy Digital Downloads – Simple eCommerce for Selling Digital Files →
CVE-2022-2387 The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment… 4.3 Medium CVE-2022-0706 The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the… Not rated
Track this CVE