Easy Digital Downloads CVE-2026-105190

Exploitable specifically when the site administrator has DISABLED user registration (WordPress 'Anyone can register' setting off) - the plugin fails to consult this setting, so the protection the operator relies on is silently bypassed; on sites where registration is already enabled the flaw adds little. No authentication, user interaction, or special attacker privileges are required (PR:N/UI:N). The key limiting factor on real-world impact is the site's configured default role: a standard 'Subscriber' default yields only a low-privilege foothold, whereas an elevated default role would materially increase severity. Requires the vulnerable Easy Digital Downloads plugin at a version before 3.7.1.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N) correctly reflects remote, unauthenticated, low-complexity exploitation with no user interaction, but the impact is deliberately scoped to I:L only (C:N/A:N) - the flaw lets an attacker create an account and obtain a logged-in session, not read data or disrupt service. Exploitation status is 'publicly available exploit code exists' (WPScan POC referenced); this is NOT confirmed active exploitation - there is no CISA KEV listing and no EPSS score was provided in the input, so widespread automated exploitation cannot be asserted from the data. No SSVC decision framework data was supplied. The real-world severity hinges on a signal the raw CVSS does not capture: the site's configured default role. On a default WordPress install the new account is a low-privilege 'Subscriber', so impact is limited to bypassing a disabled-registration policy; if an administrator has set the default role higher, impact escalates accordingly. Note a minor labeling tension: the vulnerability is a broken access-control / improper-authorization flaw (integrity impact, account creation), yet it carries an 'Information Disclosure' tag, which is inconsistent with the CVSS C:N and the described behavior - verify categorization.

An attacker targets a WordPress site running Easy Digital Downloads before 3.7.1 whose owner has intentionally disabled public user registration. The attacker sends an unauthenticated request to the plugin's account-creation flow, which fails to check the site's registration setting, and is issued a new account with the site's default role plus an active logged-in session. A publicly available WPScan POC demonstrates the technique, lowering the barrier to opportunistic exploitation.