CVE-2025-11271: Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verificationoverride=1. Because this value is attacker-supplied, an unauthenticated actor can submit a forged IPN and have it treated as verified, even on production sites and with verification otherwise enabled. A valid PayPal transaction id is needed, restricting order manipulation to orders placed by the attacker. This, in turn, requires them to have a customer account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11271?
CVE-2025-11271 is considered a high severity vulnerability due to the potential for order manipulation.
How do I fix CVE-2025-11271?
Updating the Easy Digital Downloads plugin to version 3.5.3 or later will resolve CVE-2025-11271.
What are the risks associated with CVE-2025-11271?
CVE-2025-11271 allows attackers to manipulate order verification, potentially resulting in unauthorized access to order details.
Which versions of Easy Digital Downloads are affected by CVE-2025-11271?
All versions of Easy Digital Downloads up to and including 3.5.2 are vulnerable to CVE-2025-11271.
Is there any workaround for CVE-2025-11271 before updating?
There are no recommended workarounds for CVE-2025-11271; the best course of action is to update the plugin.