CVE-2022-0707CWE-352

Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

published April 18, 2022

CVSS
—
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-04-18T17:10Z
EPSS history
Timeline
  • 18 APR 17:10Z
    Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF
    cvelistv5