CVE-2022-2439
Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization
The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
Reserved 2022-07-15 | Published 2024-09-24 | Updated 2024-09-24 | Assigner WordfenceCWE-502 Deserialization of Untrusted Data
| 2024-09-23: | Disclosed |
Rasoul Jahanshahi
www.wordfence.com/...-08ad-4048-ae91-041f1771f1dc?source=cve
plugins.trac.wordpress.org/...in/import/import-functions.php
plugins.trac.wordpress.org/...3.3.4/src/Utils/FileSystem.php
Support options
