Easy Digital Downloads CVE-2026-105194

Requires an authenticated account with at least subscriber-level role (PR:L) on a WordPress site running Easy Digital Downloads prior to 3.7.1 that uses the affected order-data block (e.g., a recent-order-products/order-history block). Exploitation is most realistic on sites that permit open/self-service user registration, since any registered low-privilege user can then enumerate other customers' order data and signed download links. Limiting factors: valid authentication is required (not fully anonymous), the vulnerable block must be in use, and sites that disable public registration substantially shrink the attacker pool.

This is a moderate-severity authenticated information disclosure (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-200). The attack vector is network-based with low complexity, but PR:L confirms it requires at least subscriber-level authentication, which meaningfully limits the attacker population to registered users of the site. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is elevated above a pure data-leak because the flaw not only exposes other customers' recent order products but also yields signed download links that let an attacker obtain paid digital files without purchase - effectively a confidentiality breach with a monetization/fraud angle. Overall this is a real-but-not-urgent priority: patch in normal cycles, prioritized higher for sites that allow open user registration. Note: no independent exploitation-probability signal (EPSS) was supplied, so the likelihood estimate rests on CVSS metrics and the WPScan advisory alone.

An attacker registers a free subscriber-level account (or uses any existing low-privilege account) on a WordPress site running Easy Digital Downloads before 3.7.1. They request the order-data block and, because order data is not scoped to the current user, retrieve other customers' recent order products along with signed download links, then use those links to download paid digital files without paying. No public proof-of-concept exploit was identified in the provided intelligence.