CVE-2023-23489: SQL Injection
First published: Fri Jan 20 2023(Updated: )
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sandhillsdev Easy Digital Downloads | <3.1.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-23489?
CVE-2023-23489 is a vulnerability affecting the Easy Digital Downloads WordPress Plugin versions 3.1.0.2 & 3.1.0.3.
What is the severity of CVE-2023-23489?
The severity of CVE-2023-23489 is critical with a CVSS score of 9.8.
How does CVE-2023-23489 impact the Easy Digital Downloads Plugin?
CVE-2023-23489 is an unauthenticated SQL injection vulnerability in the 's' parameter of the 'edd_download_search' action in Easy Digital Downloads Plugin.
Which versions of the Easy Digital Downloads Plugin are affected by CVE-2023-23489?
Versions 3.1.0.2 and 3.1.0.3 of Easy Digital Downloads Plugin are affected by CVE-2023-23489.
Is there a fix available for CVE-2023-23489?
Yes, the fix for CVE-2023-23489 is available in Easy Digital Downloads Plugin version 3.1.0.4 and above.
- collector/nvd-index
- vendor/sandhillsdev
- canonical/sandhillsdev easy digital downloads