Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF

The plugin does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack

https://example.com/wp-admin/edit.php?post_type=download&page=edd-payment-history&payment%5B0%5D=1&payment%5B1%5D=2&action=delete