CVE-2022-0707

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions prior to 2.11.6

Description The issue concerns a lack of CSRF check when inserting payment notes, potentially allowing attackers to make a logged admin insert arbitrary notes via a CSRF attack.

Recommendations For versions prior to 2.11.6, update to version 2.11.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the payment notes insertion functionality to minimize the risk of exploitation.