CVE-2025-11271
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Easy Digital Downloads plugin for WordPress in all versions up to and including 3.5.2 is vulnerable to Order Manipulation due to an order verification bypass. When the POST body includes verification_override=1, verification is unconditionally skipped, allowing an unauthenticated attacker to submit a forged IPN that is treated as verified. A valid PayPal transaction id is required, restricting order manipulation to orders placed by the attacker with a customer account.
Risk Assessment
An attacker can manipulate orders on a production site even when verification is enabled, potentially leading to unauthorized order status changes and financial losses.
Recommendation
Update the Easy Digital Downloads plugin to a version later than 3.5.2 that removes the verification_override bypass.
Other vulnerabilities in Easy Digital Downloads
See all- CVE-2026-66476Medium
Administrator Arbitrary File Deletion in Easy Digital Downloads versions up to 3.6.9.
- CVE-2026-59524Medium
Easy Digital Downloads plugin version 3.6.7 and earlier contains a broken authentication vulnerability that does not require authentication. An attacker can gain unauthorized access to administrative functions.
- CVE-2026-42638High
Missing Authorization vulnerability in Easy Digital Downloads allows exploiting incorrectly configured access control security levels. Affects versions through 3.7.1.
- CVE-2026-95522High
The Easy Digital Downloads plugin in versions up to and including 3.7.0 contains an SQL Injection vulnerability accessible to users with the Shop manager role. This allows injection of malicious SQL code into database queries.
- CVE-2026-12476High
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.
- CVE-2026-39503High
Easy Digital Downloads versions up to 3.6.5 have a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verification_override=1. Because this value is attacker-supplied, an unauthenticated actor can submit a forged IPN and have it treated as verified, even on production sites and with verification otherwise enabled. A valid PayPal transaction id is needed, restricting order manipulation to orders placed by the attacker. This, in turn, requires them to have a customer account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS