Executive Summary

This vulnerability exists in the Easy Digital Downloads plugin for WordPress up to version 3.5.2. It allows an attacker to bypass order verification by including a specific parameter (verification_override=1) in the POST request body. Because this parameter is attacker-controlled, an unauthenticated attacker can submit a forged Instant Payment Notification (IPN) that the system treats as verified, even when verification is enabled. However, the attacker must have a valid PayPal transaction ID and a customer account, limiting the manipulation to orders they place themselves.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to manipulate orders by bypassing the verification process, potentially enabling them to fraudulently confirm orders they placed. This could lead to unauthorized access to products or services without proper payment confirmation, causing financial loss or disruption to the business operations.

Useful 0 Not Useful 0