Easy Digital Downloads: SQL injection

Easy Digital Downloads is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

CVE / CNA score 9.8 CVSS · cve@mitre.org

NVD score 9.8 CVSS 3.1 · nvd@nist.gov

Component: Easy Digital Downloads
Plugin slug: easy-digital-downloads
Affected: See vendor advisory
Safe version: See mitigation notes
Published: Aug 16, 2019
Weakness: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

This CVE was published Aug 16, 2019 and is one of 66 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Easy Digital Downloads to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.

NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Patch or disable the affected component.

Technical description

Primary and upstream sources