5.3
Medium
CVE-2025-11271 The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and…
Description
The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verification_override=1. Because this value is attacker-supplied, an unauthenticated actor can submit a forged IPN and have it treated as verified, even on production sites and with verification otherwise enabled. A valid PayPal transaction id is needed, restricting order manipulation to orders placed by the attacker. This, in turn, requires them to have a customer account.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy 3.5 | earliest → 3.5.2 | No fix stated |
Other CVEs of Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
The 17 CVEs of Easy Digital Downloads – eCommerce Payments and Subscriptions made easy →
CVE-2026-120538
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator…
8.1
High
CVE-2026-14335
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored…
7.2
High
CVE-2026-12476
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including…
7.2
High
CVE-2026-7533
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and…
4.3
Medium