CVE-2023-23489

🗓️ 20 Jan 2023 00:00:00Reported by tenableType

cve🔗 web.nvd.nist.gov👁 121 Views🌐 WEB

The Easy Digital Downloads WordPress Plugin3.1.0.2 & 3.1.0.3, unauthenticated SQL injection vulnerability in 's' paramete

Reporter	Title	Published	Views	Family All 17
BDU FSTEC	Vulnerability of the edd_ajax_download_search() function (/includes/ajax-functions.php) of the Easy Digital Downloads plugin in the WordPress content management system, allowing a hacker to execute arbitrary SQL queries	22 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-23489	16 Jan 202317:30	–	circl
CNNVD	WordPress Plugin The Easy Digital Downloads SQL注入漏洞	20 Jan 202300:00	–	cnnvd
Cvelist	CVE-2023-23489	20 Jan 202300:00	–	cvelist
Nuclei	WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection	28 Jun 202603:02	–	nuclei
NVD	CVE-2023-23489	20 Jan 202318:15	–	nvd
OpenVAS	WordPress Easy Digital Downloads Plugin 3.1.0.2 - 3.1.0.3 SQLi Vulnerability	5 Sep 202300:00	–	openvas
OSV	CVE-2023-23489	20 Jan 202318:15	–	osv
Patchstack	WordPress Easy Digital Downloads Plugin <= 3.1.0.3 is vulnerable to SQL Injection	14 Jan 202300:00	–	patchstack
Prion	Sql injection	20 Jan 202318:15	–	prion

NVD

Node

sandhillsdev easy_digital_downloadsRange<3.1.0.4wordpress

[
  {
    "vendor": "n/a",
    "product": "Easy Digital Downloads WordPress Plugin",
    "versions": [
      {
        "version": "< 3.1.0.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2023-2

Parameter	Position	Path	Description	CWE
s	query param	wp-admin/admin-ajax.php?action=edd_download_search&s=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(2)))a)--+-	Unauthenticated SQL injection via unsanitized s parameter in the edd_download_search AJAX action	CWE-89

17 Jun 2026 05:37Current

9.9High risk

Vulners AI Score9.9

CVSS 3.19.8

EPSS0.11172

SSVC