PT-2024-39742 · WordPress · Easy Digital Downloads

Arkadiusz Hydzik · Published 2024-12-17 · Updated 2024-12-17 · CVE-2024-9654

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads plugin for WordPress versions 3.1 through 3.3.4

Description The issue arises from a lack of sufficient validation checks within the verify guest email function, allowing unauthenticated attackers to bypass security restrictions and view other users' receipts. These receipts contain links to download paid content. To exploit this, an attacker needs to know another customer's email address and the file ID of the content they purchased.

Recommendations For versions 3.1 through 3.3.4, consider disabling the verify guest email function until a patch is available to prevent unauthorized access to purchase receipts. Restrict access to the receipt generation process to minimize the risk of exploitation. Avoid using the verify guest email function in conjunction with unvalidated user input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-9654

Affected Products

Easy Digital Downloads

References · 6

• https://osv.dev/vulnerability/CVE-2024-9654 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3188001/easy-digital-downloads/trunk/includes/blocks/includes/orders/functions.php?old=2990247&old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fblocks%2Fincludes%2Forders%2Ffunctions.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-9654 · Security Note
• https://t.me/cvedetector/13083 · Telegram Post
• https://twitter.com/CVEnew/status/1869005766142967832 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d3f4de75-abf5-46e8-854d-be91ed74a5f3?source=cve · Note