Input validation vulnerability in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy 3.5.2

The Easy Digital Downloads plugin for WordPress has a security issue that allows for Order Manipulation. This problem affects all versions up to and including 3.5.2. The issue is due to a bypass in the order verification process. This means that if the attacker includes a specific value in the POST body, the verification will be skipped. This allows the attacker to submit a fake payment notification and have it accepted as legitimate, even on live websites with verification enabled. To exploit this vulnerability, the attacker needs a valid PayPal transaction id and a customer account.