eCommerce Product Catalog < 3.0.18 - CSRF Nonce Bypass

The plugin did not properly check the CSRF nonce in the ic_orders.save() function, which could allow attackers to make a logged in user with the edit_digital_order capability save arbitrary digital orders.