PT-2025-34039 · WordPress · Sendwp+1

Wesley · Published 2025-08-20 · Updated 2025-08-20 · CVE-2025-8102

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads versions prior to 3.5.1

Description: The Easy Digital Downloads plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing nonce validations in the edd sendwp disconnect() and edd sendwp remote install() functions. This allows unauthenticated attackers to deactivate or download and activate the SendWP plugin through a forged request by tricking a site administrator into performing an action, such as clicking a link.

Recommendations: Update Easy Digital Downloads to version 3.5.1 or later. As a temporary workaround, consider disabling the SendWP plugin until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-8102

Affected Products

Easy Digital Downloads

Sendwp

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-8102 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/636c9d92-ee62-499d-8d73-33cd63bb5af8?source=cve · Note
• https://twitter.com/CVEnew/status/1958180758344122831 · Twitter Post
• https://wordpress.org/plugins/easy-digital-downloads/#developers · Note
• https://twitter.com/VulmonFeeds/status/1958253464418472278 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3346633/easy-digital-downloads/trunk/includes/deprecated-functions.php?old=3328623&old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fdeprecated-functions.php · Note
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.5.0/includes/deprecated-functions.php#L1678 · Note