CVE-2024-35629 — AI Deep Analysis Summary

🚨 **Essence**: A critical security flaw in the 'Easy Digital Downloads – Recent Purchases' plugin for WordPress. 📉 **Consequences**: The vulnerability allows for **Remote File Inclusion (RFI)**.…

🛡️ **Root Cause**: **CWE-98** (Improper Control of Filename for Include). 🐛 **Flaw**: The plugin fails to properly sanitize or validate file names used in include operations.…

👥 **Affected Vendor**: Wow-Company. 📦 **Product**: Easy Digital Downloads – Recent Purchases. 📅 **Versions**: Version **1.0.2 and earlier**. If you are running any version ≤ 1.0.2, you are vulnerable. Update immediately!

💀 **Attacker Capabilities**: With **CVSS Score High (9.8)**, attackers can achieve: 🔓 **Full Control**: Execute arbitrary code on the server. 📂 **Data Breach**: Steal sensitive customer purchase data.…

🔓 **Exploitation Threshold**: **Low**. 🌐 **Access**: Network Accessible (AV:N). 🛑 **Auth**: No Privileges Required (PR:N). 🖱️ **User Interaction**: Required (UI:R) - likely via a click or specific request.…

📢 **Public Exploit**: **No PoC available** in the provided data. 🕵️ **Status**: While no public Proof-of-Concept (PoC) is listed, the vulnerability type (RFI) is well-known.…

🔍 **Self-Check Method**: 1. Check your WordPress Admin Dashboard for the plugin 'Easy Digital Downloads – Recent Purchases'. 2. Verify the version number. 3. If it is **1.0.2 or lower**, you are at risk. 4.…

✅ **Official Fix**: **Yes**. The vulnerability was published on **2024-06-04**. The vendor (Wow-Company) is expected to release a patched version > 1.0.2.…

🚧 **No Patch Workaround**: If you cannot update immediately: 1. **Disable** the plugin entirely if not in use. 2. **Restrict Access**: Limit access to the plugin's endpoints via firewall/WAF. 3.…

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **Immediate Action Required**. With a CVSS of 9.8 (Critical) and no authentication required, this is a high-priority target for automated bots.…