The Easy Digital Downloads WordPress plugin allows an attacker to submit a forged PayPal IPN request that bypasses order verification when the POST body contains the parameter verification_override=1. Because this value is supplied by the attacker, the plugin treats the request as verified regardless of the normal verification setting. The attacker must supply a valid PayPal transaction ID and have an existing customer account, but otherwise can have the order status altered or created without actual payment confirmation, potentially leading to unauthorized fulfillment and financial loss.

WordPress sites that use the Easy Digital Downloads eCommerce plugin version 3.5.2 or earlier. The plugin vendor is smub and the product is the Easy Digital Downloads plugin for WordPress. Any site running a version up to and including 3.5.2 is vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% suggests that exploitation is unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to send arbitrary HTTP POST requests to the PayPal IPN endpoint, the knowledge of a valid PayPal transaction ID, and an existing user account on the site. Once these conditions are met, an unauthenticated actor can have the order marked as verified and influence order state without proper payment confirmation.