CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2023-23489Public Exploit

Easy Digital Downloads - SQLi (CVE-2023-23489)

PublishedJan 20, 2023
First SeenDec 5, 2024
Last Seen
Reported
CVSS9.8
AM
Awesome MotiveEasy Digital Downloads WordPress Plugin
cmswordpress

Description

The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.

psychologyCrowdSec Analysis

CVE-2023-23489 is a vulnerability in the Easy Digital Downloads WordPress Plugin that allows unauthenticated attackers to perform SQL injection via specially crafted requests to a search action.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-23489 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attempts to exploit this vulnerability typically interact with search-related endpoints of the affected plugin's API.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2023-01-20
Rule Released2023-12-15
CrowdSec First Seen2024-12-05

Related Weaknesses

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References