Hi there @rclilly,
Thanks for flagging this, and for taking steps to protect your site in the meantime. A firewall rule is a sensible precaution until the update is out.
We’re aware of the vulnerability and are treating it as a top priority. A security update fixing it is being released today.
Patchstack published this without first reporting it to us through responsible disclosure, so we didn’t have the chance to ship a fix before it became public. When issues are reported to us directly, we turn fixes around quickly, and we’re moving just as fast here.
We’ll update this thread as soon as the release is available. Once it is, please update right away. You can keep your Cloudflare rule in place too, if you’d like the extra layer.
Thanks for your patience.
Thanks for your patience @rclilly
We’ve released version 3.7.1.1 of Easy Digital Downloads and worked with the Plugins team to ensure that it is available for updates.
Hi Chris, thanks for the quick reply and the quick patch! That’s a bummer that Patchstack released this publicly before contacting you folks. That explains why I didn’t see an update available earlier.
Why wasn’t it mentioned in the changelog that 3.7.1.1 contained a vulnerability patch?
Coincidentally I came across this post, and I had held off on installing 3.7.1.1 because I didn’t get around to testing it yet. The changelog entry didn’t seem very impactful either.
