CVE-2022-2439
High
Description
The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
SeverityHigh
CVSS7.2
Exploit probability53. percentile0.7%
ProductAwesomemotive Easy Digital Downloads
PublishedSep 24, 2024
First seenSep 24, 2024
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- awesomemotive easy_digital_downloads3.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| awesomemotive easy_digital_downloads | v < 3.3.4 | 3.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.