CVE-2025-8102: Easy Digital Downloads CSRF Vulnerability

CVE-2025-8102 Overview

CVE-2025-8102 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Easy Digital Downloads plugin for WordPress in all versions up to and including 3.5.0. The flaw stems from missing nonce validation in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. Unauthenticated attackers can deactivate the SendWP integration or trigger installation and activation of the SendWP plugin by tricking a site administrator into clicking a crafted link. Exploitation requires user interaction from an authenticated administrator, but the attacker themselves needs no credentials.

Critical Impact
Successful exploitation allows unauthenticated attackers to force administrators to install, activate, or deactivate the SendWP plugin on affected WordPress sites, altering site functionality without consent.

Affected Products

Easy Digital Downloads plugin for WordPress, versions up to and including 3.5.0
WordPress installations with the vulnerable plugin active
Sites that have integrated or previously integrated the SendWP transactional email service

Discovery Timeline

2025-08-20 - CVE-2025-8102 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8102

Vulnerability Analysis

The vulnerability exists in the Easy Digital Downloads plugin, an e-commerce platform for selling digital products on WordPress. Two functions handling SendWP integration, edd_sendwp_disconnect() and edd_sendwp_remote_install(), execute privileged actions without verifying a WordPress nonce token. Nonces are the primary WordPress mechanism for preventing CSRF attacks on administrative actions.

Without nonce validation, these endpoints accept any request that carries valid administrator session cookies. An attacker can host a page containing an auto-submitting form or image tag that targets the vulnerable endpoints. When a logged-in administrator visits the attacker-controlled page, the browser transmits authentication cookies alongside the forged request, and the plugin executes the requested action.

Root Cause

The root cause is missing CSRF protection. The affected functions do not call check_admin_referer() or wp_verify_nonce() before performing state-changing operations. WordPress security guidance requires nonce checks on any handler that modifies configuration, installs plugins, or triggers remote actions. Because these checks are absent, the browser's automatic inclusion of session cookies is sufficient to authorize the request from an attacker's perspective.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a malicious webpage or email containing a link or embedded resource that issues a request to the vulnerable endpoint on a target site. The attacker then delivers the link to an administrator via phishing, forum posts, or social engineering. When the administrator, already authenticated to the target WordPress site, activates the payload, the request executes with administrative privileges. The impact is limited to the two SendWP-related functions, resulting in low integrity and low availability impact rather than full site compromise.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report and the WordPress Changeset Update for source-level details.

Detection Methods for CVE-2025-8102

Indicators of Compromise

Unexpected activation, installation, or deactivation events for the SendWP plugin in WordPress activity logs.
HTTP POST or GET requests to admin endpoints invoking edd_sendwp_disconnect or edd_sendwp_remote_install with Referer headers pointing to external domains.
Administrator sessions triggering plugin state changes shortly after clicking external links or opening email content.
New plugin files appearing on disk under wp-content/plugins/sendwp/ without a corresponding administrator-initiated install action.

Detection Strategies

Inspect web server access logs for requests to wp-admin/admin.php or admin-ajax.php that reference the vulnerable function names and lack a same-origin Referer header.
Enable and review WordPress audit logging plugins to track plugin install, activate, and deactivate events with associated user and source IP.
Correlate administrator authentication events with subsequent plugin state changes to identify actions that were not initiated from the WordPress dashboard.

Monitoring Recommendations

Alert on any plugin installation or activation event triggered outside a maintenance window.
Monitor outbound requests from the WordPress server to SendWP infrastructure that follow unexpected administrative actions.
Track file integrity for the wp-content/plugins/ directory and flag new plugin directories that appear without change-management approval.

How to Mitigate CVE-2025-8102

Immediate Actions Required

Update the Easy Digital Downloads plugin to a version later than 3.5.0 that includes the fix referenced in the vendor changeset.
Audit installed plugins to confirm whether SendWP was installed or activated without authorization and remove it if unwanted.
Instruct administrators to log out of WordPress before browsing untrusted content and to use a separate browser profile for admin work.

Patch Information

The vendor addressed the issue in the WordPress plugin repository. The relevant fix moves the vulnerable functions into deprecated handling and adds proper request validation. See the WordPress Changeset Update and the WordPress Plugin Developer Info for authoritative details on the fixed release.

Workarounds

Restrict administrator access to the WordPress dashboard using IP allowlisting at the web server or WAF layer until the plugin is updated.
Deploy a web application firewall rule that blocks unauthenticated or cross-origin requests targeting edd_sendwp_disconnect and edd_sendwp_remote_install.
Enforce SameSite cookie attributes on WordPress session cookies to reduce the effectiveness of cross-site request forgery.
Require administrators to re-authenticate before performing plugin management actions using a security plugin that enforces step-up authentication.

bash

# Example WAF rule concept blocking cross-origin requests to vulnerable actions
# (adapt syntax to your WAF platform)
SecRule REQUEST_URI "@rx (edd_sendwp_disconnect|edd_sendwp_remote_install)" \
  "id:1008102,phase:1,deny,status:403,\
   chain,msg:'CVE-2025-8102 CSRF attempt against Easy Digital Downloads'"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/" "t:none"