{"affected":[{"affectedData":[{"product":"Easy Digital Downloads – Simple eCommerce for Selling Digital Files","vendor":"Unknown","versions":[{"lessThan":"3.0","status":"affected","version":"3.0","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:awesomemotive:easy_digital_downloads:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"99F997B0-A64D-4F62-8859-406672E9E4ED","versionEndExcluding":"3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack"},{"lang":"es","value":"El complemento de WordPress Easy Digital Downloads anterior a 3.0 no cuenta con verificación CSRF al eliminar el historial de pagos y no garantiza que la publicación que se eliminará sea en realidad un historial de pagos. Como resultado, los atacantes podrían hacer que un administrador que haya iniciado sesión elimine una publicación arbitraria mediante un ataque CSRF."}],"id":"CVE-2022-2387","lastModified":"2026-06-17T04:41:48.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-2387","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-05T20:26:18.816586Z","version":"2.0.3"}}]},"published":"2022-11-07T10:15:11.413","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/db3c3c78-1724-4791-9ab6-ebb2e8a4c8b8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/db3c3c78-1724-4791-9ab6-ebb2e8a4c8b8"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"contact@wpscan.com","type":"Secondary"}]}