WordPress Plugin Vulnerabilities
Easy Digital Downloads < 2.10.3 - Unauthorised Stripe Disconnect via CSRF
Description
The plugin did not property check for CSRF when disconnecting Stripe, allowing attackers to make logged in users with the manage_options capability disconnect the Stripe gateway via a CSRF attack.
Proof of Concept
https://example.com/wp-admin/admin-post.php?page=edd-settings&edds-stripe-disconnect=1
Affects Plugins
Fixed in version 2.10.3
References
Classification
Miscellaneous
Timeline
Publicly Published
2021-04-16 (about 1 years ago)
Added
2021-04-16 (about 1 years ago)
Last Updated
2021-04-16 (about 1 years ago)