Threats tagged 'ghsa-6jrq-cfpr-p7h7'

The Easy Digital Downloads WordPress plugin versions up to and including 3.5.2 contain a vulnerability that allows unauthenticated attackers to manipulate orders by bypassing order verification. This occurs because the plugin skips verification when the POST body includes the parameter verification_override=1, which attackers can supply. Exploitation requires the attacker to have a valid PayPal transaction ID and a customer account, limiting manipulation to their own orders.