PT-2022-21895 · WordPress · Easy Digital Downloads

Robert Rowley · Published 2022-08-22 · Updated 2023-08-08 · CVE-2022-33900

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads plugin versions prior to 3.0.2

Description A PHP Object Injection issue affects the Easy Digital Downloads plugin at WordPress.

Recommendations For versions prior to 3.0.2, update to version 3.0.2 or later to resolve the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-33900

Affected Products

Easy Digital Downloads

References · 5

• https://patchstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-0-1-php-object-injection-vulnerability · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-33900 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33900 · Vendor Advisory
• https://wordpress.org/plugins/easy-digital-downloads/#developers · Note
• https://t.me/cibsecurity/48480 · Telegram Post