CVE-2022-2387: Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2387?
CVE-2022-2387 is considered a significant vulnerability due to its potential to allow unauthorized deletion of arbitrary posts by an attacker.
How do I fix CVE-2022-2387?
To fix CVE-2022-2387, upgrade the Easy Digital Downloads WordPress plugin to version 3.0 or later.
What impact does CVE-2022-2387 have on my WordPress site?
CVE-2022-2387 can allow an attacker to manipulate the payment history and delete important posts without proper authorization.
Who is affected by CVE-2022-2387?
Any WordPress site using Easy Digital Downloads plugin versions before 3.0 is vulnerable to CVE-2022-2387.
Is there a workaround for CVE-2022-2387?
There is no official workaround for CVE-2022-2387; the recommended solution is to update to the latest plugin version.