The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
References
Configurations
History
07 Feb 2025, 17:09
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:awesomemotive:easy_digital_downloads:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-22 | |
| First Time |
Awesomemotive easy Digital Downloads
Awesomemotive |
|
| References | () https://plugins.trac.wordpress.org/changeset/3131805/easy-digital-downloads/tags/3.3.3/includes/process-download.php - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/ec065da7-b8aa-414d-9673-5caf87ad45b5?source=cve - Third Party Advisory |
21 Dec 2024, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-21 12:15
Updated : 2025-02-07 17:09
NVD link : CVE-2024-12875
Mitre link : CVE-2024-12875
JSON object : View
Products Affected
awesomemotive
- easy_digital_downloads
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')