7.2
Élevée
CVE-2022-2439 The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to…
Description
The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy 3.3 | premières → 3.3.3 | Pas de correctif indiqué |
| easy_digital_downloads 3.3 | premières → 3.3.3 | Pas de correctif indiqué |
Autres CVE de Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Les 17 CVE de Easy Digital Downloads – eCommerce Payments and Subscriptions made easy →
CVE-2026-120538
Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
8.1
Élevée
CVE-2026-14335
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored…
7.2
Élevée
CVE-2026-12476
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including…
7.2
Élevée
CVE-2026-7533
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and…
4.3
Moyenne