CVE-2022-2387 Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF
Attackers can trick logged-in admins into deleting arbitrary posts via CSRF in the Easy Digital Downloads plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-2387?
CVE-2022-2387 is a medium-severity vulnerability in Awesomemotive Easy Digital Downloads, published on 7 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
Weakness: CWE-352
Which versions are affected by CVE-2022-2387?
It affects 1 product.
Products include Awesomemotive Easy Digital Downloads.
How do I fix CVE-2022-2387?
No fix has been published for CVE-2022-2387 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-2387 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2387 exists.
Other vulnerabilities in Awesomemotive Easy Digital Downloads
- CVE-2023-30869 WordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege Escalation
- CVE-2022-3600 Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection
- CVE-2015-9324 SQL injection in n/a
- CVE-2024-5057 WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability
- CVE-2022-2439 Deserialization in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Sources
Also known as GHSA-pr89-cv9w-3vj3.