CVE-2022-2387
published 2022-11-07CVE-2022-2387: The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be…
PriorityP420medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
0.29%
20.3th percentile
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| awesomemotive | easy_digital_downloads | < 3.0 | 3.0 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
cisa7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Easy Digital Downloads Plugin up to 2.x on WordPress Payment History cross-site request forgery (EUVD-2022-34653)
vuldb·2026-05-25·CVSS 4.3
CVE-2022-2387 [MEDIUM] Easy Digital Downloads Plugin up to 2.x on WordPress Payment History cross-site request forgery (EUVD-2022-34653)
A vulnerability was found in Easy Digital Downloads Plugin up to 2.x on WordPress. It has been rated as problematic. Impacted is an unknown function of the component Payment History Handler. This manipulation causes cross-site request forgery.
This vulnerability is handled as CVE-2022-2387. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is advised.
GHSA
GHSA-pr89-cv9w-3vj3: The Easy Digital Downloads WordPress plugin before 3
ghsa_unreviewed·2022-11-07
CVE-2022-2387 [MEDIUM] CWE-352 GHSA-pr89-cv9w-3vj3: The Easy Digital Downloads WordPress plugin before 3
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
CISA
Microsoft ATM Font Driver Privilege Escalation Vulnerability
cisa·2022-03-03·CVSS 7.8
CVE-2015-2387 [HIGH] CWE-264 Microsoft ATM Font Driver Privilege Escalation Vulnerability
Vulnerability: Microsoft ATM Font Driver Privilege Escalation Vulnerability
Affected: Microsoft ATM Font Driver
ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2015-2387
Remediation Due Date: 2022-03-24
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-07
Published