The Easy Digital Downloads plugin for WordPress suffers from a CSRF vulnerability (CWE-352) due to missing nonce validation in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. This flaw permits unauthenticated attackers to perform actions such as deactivating or installing the SendWP plugin by tricking an administrator into clicking a malicious link. The vulnerability affects all versions up to and including 3.5.0. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker can cause a site administrator to unknowingly deactivate or install the SendWP plugin by exploiting CSRF, potentially disrupting site functionality or introducing unwanted plugins. The vulnerability does not impact confidentiality but has low impact on integrity and availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links while logged into the WordPress admin interface and consider implementing additional CSRF protections or security plugins that enforce nonce validation.