CVE-2022-0707

CVE-2022-0707: Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

Vendor Unknown

Product Easy Digital Downloads – Simple eCommerce for Selling Digital Files

Weakness CWE-352 · CSRF

Published April 18, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

Key dates

02Disclosure timeline

April 18, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0707 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

04Related CVE

CVE-2024-12349 JFinalCMS save cross-site request forgery CVE-2023-36693 WordPress WP RSS Images Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2024-4600 Cross-Site Request Forgery vulnerability in Socomec Net Vision CVE-2025-30552 WordPress WordPress Admin Bar Improved plugin <= 3.3.5 - CSRF to Stored XSS vulnerability CVE-2025-39371 WordPress Author Box Plugin With Different Description plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability