https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T20:29:55.444304+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2022-2439 CVE-2022-2439 — Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserializat… 2026-10-09T20:29:55.461247+00:00

Affected: smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy, easydigitaldownloads easy_digital_downloads

The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.