CVE-2022-2387

CVE-2022-2387: Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF

Vendor Unknown

Product Easy Digital Downloads – Simple eCommerce for Selling Digital Files

Weakness CWE-352 · CSRF

Published November 7, 2022

Last update May 5, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack

Key dates

02Disclosure timeline

November 7, 2022 CVE published

May 5, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2387 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

04Related CVE

CVE-2025-9880 Side Slide Responsive Menu <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2025-66064 WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-51654 WordPress APK Downloader plugin <= 1.0.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability CVE-2026-43877 WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes CVE-2024-4587 DedeCMS tpl.php cross-site request forgery