Easy Digital Downloads CVE-2026-116403

Exploitation targets the plugin's improper synchronization of a shared resource and is reachable remotely without authentication (PR:N) or user interaction (UI:N) against Easy Digital Downloads versions through 3.7.1. The key limiting factor is AC:H: the attacker must reliably win a concurrency/timing window, which is non-deterministic and typically requires many concurrent or repeated attempts. Impact is confined to integrity (I:H); there is no confidentiality or availability impact per the vector. The exact vulnerable operation, endpoint, and trigger conditions are not described in the available sources, so the precise configuration or code path required cannot be stated from the input.

This is a medium-severity (CVSS 5.9) integrity-only race condition (CWE-362) in the Easy Digital Downloads WordPress plugin, affecting all versions up to and including 3.7.1. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) indicates a network-reachable, unauthenticated flaw with no user interaction, but high attack complexity (AC:H) and impact limited to integrity (I:H) with no confidentiality or availability loss. No EPSS probability, CISA KEV listing, or SSVC automatable/technical-impact fields were supplied, so exploitation likelihood cannot be quantified from the input; the only probabilistic signal is the vuln.today priority label 'this_month', which denotes a near-term patch priority rather than active exploitation. There is no public exploit identified - the sole reference is the Patchstack advisory/database entry, not verified working exploit code. The AC:H metric means an attacker must reliably win a timing window against a shared resource, which materially lowers real-world exploitability despite the network, unauthenticated vector. Note a signal conflict: the input Tags include 'Information Disclosure', yet the CVSS vector is C:N/I:H - the scored impact is integrity, not confidentiality, so the disclosure framing should be verified against the vendor advisory. Overall this is a genuine but moderate-priority issue: patch on a normal cycle rather than an emergency, consistent with the 'this_month' decision label.

A remote, unauthenticated attacker sends concurrent requests to a vulnerable Easy Digital Downloads endpoint to race an improperly synchronized operation on a shared resource, aiming to corrupt or manipulate state (integrity impact) without reading protected data or taking the site down. Because AC:H applies, success requires repeatedly attempting to hit a narrow timing window, so exploitation is non-deterministic. No verified public exploit code exists; the specific vulnerable operation and trigger are not described in the available sources.