Skip to main content

Easy Digital Downloads CVE-2023-40005

MEDIUM
Missing Authorization (CWE-862)
2024-12-13 audit@patchstack.com
WordPress Authentication Bypass Easy Digital Downloads Wordpress Plugin Awesomemotive
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
Severity Changed
Apr 29, 2026 - 10:22 NVD
CRITICAL MEDIUM
CVSS changed
Apr 29, 2026 - 10:22 NVD
9.8 (CRITICAL) 5.3 (MEDIUM)
CVE Published
Dec 13, 2024 - 15:15 cve.org
MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Syed Balkhi Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through <= 3.1.5.

AnalysisAI

Missing Authorization vulnerability in Syed Balkhi Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.1.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. Missing Authorization vulnerability in Syed Balkhi Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.1.5. Affected products include: Awesomemotive Easy Digital Downloads.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.

More in Easy Digital Downloads

View all
CVE-2024-5057 CRITICAL POC
9.8 Aug 29

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downl
CVE-2023-30869 CRITICAL POC
9.8 May 02

Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Rated critical severity (CVSS 9.8)
CVE-2023-23489 CRITICAL POC
9.8 Jan 20

The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection
CVE-2022-3600 CRITICAL POC
9.8 Nov 21

The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which c
CVE-2024-35629 CRITICAL
9.8 Jun 04

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
CVE-2023-0380 MEDIUM POC
5.4 Feb 21

The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before
CVE-2024-43162 HIGH
8.8 Nov 01

Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Se
CVE-2022-0706 MEDIUM POC
4.8 Apr 18

The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the
CVE-2021-39354 MEDIUM POC
4.8 Oct 21

The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end
CVE-2022-2387 MEDIUM POC
4.3 Nov 07

The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history,

CVE-2022-0707 MEDIUM POC
4.3 Apr 18

The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes
CVE-2026-39503 HIGH
7.5 Jun 15

Unauthenticated broken access control in the Easy Digital Downloads WordPress plugin (versions <= 3.6.5) allows remote a

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2023-40005 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy