CVE-2022-0707 Information

Description

The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Reference

https://plugins.trac.wordpress.org/changeset/2697388 https://wpscan.com/vulnerability/50680797-61e4-4737-898f-e5b394d89117

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

LOW

Base Score

NONE

Base Severity

4.3