CVE-2024-12875
📋 TL;DR
This vulnerability allows authenticated WordPress administrators to perform directory traversal attacks through the file download functionality, enabling them to read arbitrary files on the server. This affects all versions of the Easy Digital Downloads plugin up to and including 3.3.2.
💻 Affected Systems
- Easy Digital Downloads WordPress plugin
📦 What is this software?
Easy Digital Downloads by Awesomemotive
⚠️ Risk & Real-World Impact
Worst Case
Administrator credentials are compromised, allowing attackers to read sensitive files like wp-config.php containing database credentials, SSH keys, or other configuration files, leading to complete site takeover.
Likely Case
Malicious administrators or compromised admin accounts exfiltrate sensitive configuration data, user information, or other protected files from the server.
If Mitigated
With proper access controls and monitoring, only legitimate administrators can access the functionality, limiting exposure to trusted personnel.
🎯 Exploit Status
Exploitation requires authenticated administrator access. The vulnerability is in the file download parameter handling.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.3
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3131805/easy-digital-downloads/tags/3.3.3/includes/process-download.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find Easy Digital Downloads. 4. Click 'Update Now' if available, or download version 3.3.3+ from WordPress.org. 5. Activate the updated plugin.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the Easy Digital Downloads plugin until patched
wp plugin deactivate easy-digital-downloads
Restrict admin access
allImplement strict access controls and monitoring for administrator accounts
🧯 If You Can't Patch
- Implement strict file system permissions to limit readable directories
- Enable detailed logging of file download activities and monitor for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Easy Digital Downloads → Version. If version is 3.3.2 or lower, you are vulnerable.Check Version:
wp plugin get easy-digital-downloads --field=versionVerify Fix Applied:
Verify plugin version is 3.3.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file download patterns from admin users
- Access to files outside expected download directories
- Multiple failed download attempts with path traversal patterns
Network Indicators:
- Unusual outbound traffic from WordPress server following admin file downloads
SIEM Query:
source="wordpress.log" AND ("process-download.php" OR "edd_process_download") AND ("..\\" OR "../" OR "%2e%2e%2f")