PT-2025-45174 · WordPress · Easy Digital Downloads+1

Jamie Davies · Published 2025-11-06 · Updated 2025-11-06 · CVE-2025-11271

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions up to and including 3.5.2

Description The Easy Digital Downloads plugin for WordPress has a flaw that allows manipulation of orders. This is due to a bypass in order verification, which occurs when the verification override parameter is set to 1 in the POST body. An attacker can submit a forged IPN (Instant Payment Notification) and have it treated as verified, even if verification is normally enabled. A valid PayPal transaction id is required for this manipulation, limiting it to orders initiated by the attacker who possesses a customer account.

Recommendations Versions prior to 3.5.3 should be updated.

Fix

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2025-11271

Affected Products

Easy Digital Downloads

Wordpress

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11271 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11271 · Vendor Advisory
• https://github.com/awesomemotive/easy-digital-downloads/blob/main/src/Gateways/PayPal/IPN.php · Note
• https://github.com/awesomemotive/easy-digital-downloads/blob/main/includes/gateways/paypal/ipn.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4c63154e-9413-47ea-a740-441618266adf?source=cve · Note
• https://t.me/cveNotify/141894 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3382964%40easy-digital-downloads%2Ftrunk&old=3364285%40easy-digital-downloads%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/36670 · Telegram Post