WordPress Plugin Vulnerabilities

Easy Digital Downloads < 2.5.8 - PHP Object Injection

Description

Easy Digital Downloads unserializes user-submitted data from cookies and other request parameters, allowing for object injection.

Affects Plugins

Plugin icon
easy-digital-downloads
Fixed in 2.5.8

References

URL
https://github.com/easydigitaldownloads/Easy-Digital-Downloads/commit/7e83d2737b430c76f515b5433ee067fa5e6b1d4f

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
6.5 (medium)

Miscellaneous

Submitter
Danny van Kooten
Submitter website
http://dvk.co/
Submitter twitter
dannyvankooten
Verified
Yes
WPVDB ID
bcc1dcf9-c3f3-4895-ada7-16807cdb5d2f

Timeline

Publicly Published
2016-03-02 (about 10 years ago)
Added
2016-03-03 (about 10 years ago)
Last Updated
2021-04-13 (about 5 years ago)

Other

Published
Title
Published
2024-09-27
Title
GiveWP – Donation Plugin and Fundraising Platform < 3.16.2 - Unauthenticated PHP Object Injection
Published
2025-12-11
Title
Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie
Published
2022-11-17
Title
Betheme < 26.6 - Subscriber+ PHP Object Injection
Published
2024-10-14
Title
TAKETIN To WP Membership <= 2.8.17 - Subscriber+ PHP Object Injection
Published
2025-09-26
Title
Icegram Express Pro < 5.9.14 - Authenticated (Administrator+) PHP Object Injection