Easy Digital Downloads Unvalidated Redirect Vulnerability in Password Reset Flow

A vulnerability allowing unvalidated redirects has been identified in the Easy Digital Downloads plugin for WordPress, affecting all versions through 3.6.2. The issue arises from inadequate validation of the redirect URL provided via the 'edd_redirect' parameter. This flaw enables unauthenticated attackers to redirect users who are receiving password reset emails to potentially harmful websites, by tricking them into taking certain actions.

Impact

Exploitation of this vulnerability could lead to users being redirected to malicious sites, potentially causing harm or allowing for further attacks.

Reproduction

To reproduce this vulnerability, an attacker can exploit the 'edd_redirect' parameter in the password reset process. By inserting a malicious URL into this parameter, it's possible to redirect users to harmful sites when they receive their password reset email. This requires convincing the user to take an action that triggers the password reset process.

Remediation

Users are advised to update the Easy Digital Downloads plugin to version 3.6.3 or later.