CVE-2023-23489: SQL Injection
Published Jan 20, 2023
·Updated
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edddownloadsearch' action.
Affected Software
1 affected component
Sandhillsdev Easy Digital Downloads Wordpress<3.1.0.4
Event History
Jan 20, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2023-23489?
CVE-2023-23489 is a vulnerability affecting the Easy Digital Downloads WordPress Plugin versions 3.1.0.2 & 3.1.0.3.
2
What is the severity of CVE-2023-23489?
The severity of CVE-2023-23489 is critical with a CVSS score of 9.8.
3
How does CVE-2023-23489 impact the Easy Digital Downloads Plugin?
CVE-2023-23489 is an unauthenticated SQL injection vulnerability in the 's' parameter of the 'edd_download_search' action in Easy Digital Downloads Plugin.
4
Which versions of the Easy Digital Downloads Plugin are affected by CVE-2023-23489?
Versions 3.1.0.2 and 3.1.0.3 of Easy Digital Downloads Plugin are affected by CVE-2023-23489.
5
Is there a fix available for CVE-2023-23489?
Yes, the fix for CVE-2023-23489 is available in Easy Digital Downloads Plugin version 3.1.0.4 and above.