vulnerability

WordPress Plugin: easy-digital-downloads: CVE-2022-2439: Deserialization of Untrusted Data

Severity
8
CVSS
(AV:N/AC:L/Au:M/C:C/I:C/A:C)
Published
Sep 23, 2024
Added
May 15, 2025
Modified
May 15, 2025

Description

The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.

Solution

easy-digital-downloads-plugin-cve-2022-2439
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.