CVE-2025-11271: Easy Digital Downloads Auth Bypass Flaw

CVE-2025-11271 Overview

CVE-2025-11271 is an order verification bypass vulnerability in the Easy Digital Downloads (EDD) plugin for WordPress. The flaw affects all versions up to and including 3.5.2. The PayPal Instant Payment Notification (IPN) handler unconditionally skips verification when the POST body contains verification_override=1. Because the value is attacker-controlled, an unauthenticated actor can submit a forged IPN and have it processed as verified. Exploitation requires a valid PayPal transaction ID, so attackers must possess a customer account and can only manipulate their own orders. The issue is tracked under [CWE-807] Reliance on Untrusted Inputs in a Security Decision.

Critical Impact
An unauthenticated attacker with a customer account and a valid PayPal transaction ID can forge IPN requests to manipulate the state of their own orders, bypassing payment verification controls.

Affected Products

Easy Digital Downloads plugin for WordPress, versions up to and including 3.5.2
WordPress sites using the EDD PayPal Standard/IPN gateway
E-commerce sites relying on EDD order verification for fulfillment

Discovery Timeline

2025-11-06 - CVE-2025-11271 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11271

Vulnerability Analysis

The vulnerability resides in the PayPal IPN handler shipped with Easy Digital Downloads. The IPN endpoint accepts POST requests that report the status of PayPal transactions. Under normal operation, the plugin contacts PayPal to verify that the IPN payload is authentic before updating order status.

The handler consults a verification_override flag before performing this remote verification. When the flag is set to 1, verification is skipped entirely. The plugin reads this flag directly from the POST body rather than from a trusted configuration source. Because the request is attacker-controlled, an external actor can supply the flag and have their forged IPN treated as if it had been confirmed by PayPal.

Exploitation is constrained by the requirement to supply a valid PayPal transaction ID. This binds the attack to orders the attacker has already placed and paid for through a legitimate customer account, limiting impact to manipulation of the attacker's own orders rather than arbitrary order tampering.

Root Cause

The root cause is a trust boundary error: a security-critical decision (whether to perform IPN verification) is based on data pulled from the untrusted HTTP request. This maps to [CWE-807] Reliance on Untrusted Inputs in a Security Decision. The override flag was likely intended for internal testing but was left reachable from unauthenticated network traffic in production builds.

Attack Vector

The attack is network-based and requires no authentication to the WordPress site. The attacker must, however, hold an EDD customer account and possess a real PayPal transaction ID linked to one of their orders. The attacker submits a crafted POST request to the EDD PayPal IPN endpoint containing forged transaction fields and verification_override=1. The handler skips the PayPal callback and applies the state changes described in the forged payload to the attacker's own order.

Refer to the Easy Digital Downloads PayPal IPN source and the WordPress plugin changeset for the corrected verification flow. No public proof-of-concept code is available; the issue is described in prose based on the vendor's fix commit and the Wordfence vulnerability report.

Detection Methods for CVE-2025-11271

Indicators of Compromise

POST requests to the EDD PayPal IPN endpoint containing the parameter verification_override=1
IPN requests originating from IP addresses not associated with PayPal's published notification ranges
Order state transitions to complete or publish without a matching outbound verification call to ipnpb.paypal.com

Detection Strategies

Inspect web server access logs for IPN endpoint hits that include verification_override in the request body or query string.
Correlate EDD order status changes with outbound network calls to PayPal's IPN verification endpoint; missing correlations indicate skipped verification.
Alert on unauthenticated POSTs to the EDD PayPal gateway path that succeed with non-PayPal source IPs.

Monitoring Recommendations

Enable verbose logging on the EDD PayPal gateway and forward logs to a centralized SIEM or data lake for retention and query.
Track order state changes per customer account and flag accounts that trigger repeated IPN callbacks against the same transaction ID.
Deploy a Web Application Firewall (WAF) rule that blocks or logs requests containing verification_override=1 targeting /edd-listener or the IPN handler path.

How to Mitigate CVE-2025-11271

Immediate Actions Required

Update Easy Digital Downloads to version 3.5.3 or later, which removes the attacker-controllable override.
Audit recent orders processed through the PayPal gateway for status changes that lack a corresponding verified IPN entry.
Review customer accounts that have interacted with the IPN endpoint since the plugin was installed and identify anomalous order state transitions.

Patch Information

The fix is shipped in Easy Digital Downloads version 3.5.3. The changeset removes the ability to bypass IPN verification through request-supplied parameters. Review the official plugin changeset for the exact code changes and validate the installed version through the WordPress admin dashboard.

Workarounds

Block requests containing verification_override=1 at the WAF or reverse proxy layer until the plugin is upgraded.
Restrict the EDD PayPal IPN endpoint to PayPal's published source IP ranges through firewall or .htaccess rules.
Temporarily disable the PayPal Standard gateway and switch to PayPal Commerce or another gateway that does not rely on the affected IPN handler.

bash

# Example ModSecurity rule to block the override parameter
SecRule REQUEST_BODY|ARGS:verification_override "@streq 1" \
  "id:1011271,phase:2,deny,status:403,\
  msg:'CVE-2025-11271 EDD IPN verification_override bypass attempt'"