Now officially on WordPress.org

CVE Database / CVE-2025-11271

CVE · Medium

CVE-2025-11271 — Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.5.3

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-11271 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.5.3 Reliance on Untrusted Inputs in a Security Decision Medium 5.3 < 3.5.3 3.5.3 2025-11-05 —

CVE-2025-11271

A security flaw exists in Easy Digital Downloads plugin for WordPress, affecting versions up to 3.5.2. The issue arises from an oversight in the order verification process, where a specific POST body parameter can be used to bypass checks entirely. This vulnerability allows unauthenticated individuals to submit fake payment notifications and have them accepted as legitimate, provided they possess a valid PayPal transaction ID and a customer account.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings