Easy Digital Downloads Plugin up to 3.5.2 on WordPress Transaction ID reliance on untrusted inputs in a security decision

Summaryinfo

A vulnerability marked as critical has been reported in Easy Digital Downloads Plugin up to 3.5.2 on WordPress. This impacts an unknown function of the component Transaction ID Handler. The manipulation leads to Remote Code Execution. This vulnerability is uniquely identified as CVE-2025-11271. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Easy Digital Downloads Plugin up to 3.5.2 on WordPress. It has been rated as critical. This issue affects an unknown code of the component Transaction ID Handler. The manipulation with an unknown input leads to a remote code execution vulnerability. Using CWE to declare the problem leads to CWE-807. The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verification_override=1. Because this value is attacker-supplied, an unauthenticated actor can submit a forged IPN and have it treated as verified, even on production sites and with verification otherwise enabled. A valid PayPal transaction id is needed, restricting order manipulation to orders placed by the attacker. This, in turn, requires them to have a customer account.

It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2025-11271. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/09/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202511-697) and EUVD (EUVD-2025-37973). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Easy Digital Downloads Plugin

Version

• 3.5.0
• 3.5.1
• 3.5.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion