The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.5.0. This vulnerability arises from missing nonce validations in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. As a result, unauthenticated attackers can deactivate or download and activate the SendWP plugin by tricking a site administrator into performing an action such as clicking on a link.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-8102 |
Exploitation
To exploit this vulnerability, an attacker must trick a site administrator into clicking a malicious link that sends a forged request to the affected WordPress site. This can be achieved through social engineering tactics, where the attacker creates a deceptive message or notification that prompts the administrator to perform an action that triggers the vulnerable functions.
Affected Products
- Easy Digital Downloads plugin for WordPress (all versions up to and including 3.5.0)
Mitigation
To mitigate this vulnerability, users should update the Easy Digital Downloads plugin to the latest version where nonce validations have been implemented. Additionally, site administrators should be cautious about clicking on links from untrusted sources and consider implementing additional security measures such as two-factor authentication.