CVE-2022-2439 Deserialization in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

High 7.2 Published 24 Sep 2024 Updated 8 Apr 2026

Authenticated administrators can exploit PHAR deserialization to execute arbitrary code via a POP chain in the Easy Digital Downloads plugin.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-2439?

CVE-2022-2439 is a high-severity unsafe deserialization vulnerability in Awesomemotive Easy Digital Downloads, published on 24 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.

Weakness: CWE-502

Which versions are affected by CVE-2022-2439?

It affects 1 product.

Products include Awesomemotive Easy Digital Downloads.

How do I fix CVE-2022-2439?

No fix has been published for CVE-2022-2439 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-2439 being exploited?

There is no known exploitation of CVE-2022-2439 in the wild and no public exploit code.

All Awesomemotive Easy Digital Downloads vulnerabilities

Sources

Also known as GHSA-jjqr-925q-xr8x.