WordPress security changelog
CRITICAL CVE-2023-30869 Modified

Easy Digital Downloads: Privilege escalation or authentication bypass

Easy Digital Downloads is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

CVE / CNA score 9.8 CVSS 3.1 · audit@patchstack.com
NVD score 9.8 CVSS 3.1 · nvd@nist.gov
Component
Easy Digital Downloads
Plugin slug
easy-digital-downloads
Affected
See vendor advisory
Safe version
See mitigation notes
Published
May 02, 2023
Weakness
CWE-287 — Improper Authentication

This CVE was published May 02, 2023 and is one of 66 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Easy Digital Downloads to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources