CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient validation on the redirect url supplied via the 'edd_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.
Explanation of Vulnerability in Simple Terms
Easy Digital Downloads versions 3.6.2 and earlier contain a weakness that allows an attacker to modify data through user interaction. The vulnerability requires no authentication but does require the victim to visit a malicious link or page. The integrity of site data can be compromised, though confidentiality and availability are not affected.
What an attacker can do
Modify site data or user information by tricking a visitor into clicking a malicious link.
Potential impact on your site
Site data integrity may be compromised; user-generated content or settings could be altered without authorization.
Conditions required to exploit
Victim must click an attacker-supplied link or visit a malicious page; no login required.
Key dates
External resources
