CVE-2025-11271

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-11271
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11271.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-11271
Published
2025-11-06T04:36:22Z
Modified
2026-08-12T03:51:40Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
Details

The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verification_override=1. Because this value is attacker-supplied, an unauthenticated actor can submit a forged IPN and have it treated as verified, even on production sites and with verification otherwise enabled. A valid PayPal transaction id is needed, restricting order manipulation to orders placed by the attacker. This, in turn, requires them to have a customer account.

Database specific 
{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-807"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11271.json"
}
References

Affected packages

Git / github.com/awesomemotive/easy-digital-downloads

Affected ranges

Type
GIT
Repo
https://github.com/awesomemotive/easy-digital-downloads
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
ba21c5020936fdd70a90e9599fed86e6fdedf8bf
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.5.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0-beta
1.1.6
1.1.7
1.1.8
1.2
1.2.1.1
1.3.3
1.4
1.4.0.1
1.4.0.2
1.4.0.3
1.4.1
1.4.1.1
1.4.4
1.5
1.5-beta
1.5.1
1.5.2
1.5.2-beta
1.6
1.6.1
1.6.2
1.6.3
1.7
1.7-beta2
1.7.1
1.8
1.8.1
1.8.2
1.8.2.1
1.8.3
1.9
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
2.*
2.0.1
2.0.2
2.0.3
2.0.4
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.2
2.2-beta2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.3
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.8
2.3.9
2.4
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.4.9
2.5
2.5.1
2.5.10
2.5.11
2.5.12
2.5.13
2.5.14
2.5.15
2.5.16
2.5.17
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.5.7
2.5.8
2.5.9
2.6
2.6.1
2.6.10
2.6.12
2.6.13
2.6.15
2.6.16
2.6.17
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7
2.7.10
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8
2.8.1
2.8.10
2.8.11
2.8.12
2.8.13
2.8.14
2.8.15
2.8.16
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
3.*
3.0-beta1
3.0-beta2
3.0-beta3
3.0-rc1
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.1
3.0.2
3.0.2.1
3.0.3
3.0.4
3.1
3.1.0.1
3.1.0.1.1
3.1.0.2
3.1.0.3
3.1.0.4
3.1.0.5
3.1.1
3.1.1.1
3.1.1.2
3.1.1.3
3.1.2
3.1.3
3.1.4
3.1.5
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.2
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.5.2
3.3.6
3.3.6.1
3.3.7
3.3.8.1
3.3.9
3.4.0
3.5.0
3.5.1
3.5.2
Other
beta4
v1.*
v1.1.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11271.json"