Easy Digital Downloads CVE-2026-39503

The target site must be running the Easy Digital Downloads WordPress plugin at version 3.6.5 or earlier with the vulnerable endpoint reachable over HTTP/HTTPS (the default for any public WordPress storefront); per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special configuration are required. Limiting factors observed in the data: impact is restricted to integrity (C:N/I:H/A:N), so the bug does not yield direct data theft, code execution, or denial of service; exploitation is also gated by the plugin actually being installed and active, and by network reachability of /wp-admin/admin-ajax.php or the EDD REST routes - sites that front WordPress with a WAF, IP allowlist, or that have deactivated EDD are not exploitable through this issue.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a network-reachable, low-complexity, unauthenticated exploit with no user interaction and high impact on integrity but no confidentiality or availability impact - consistent with an unauthenticated state-changing action rather than data exfiltration or RCE. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit code was identified at time of analysis; this suggests the issue is currently theoretical-but-credible rather than mass-exploited. Given the very large install base of Easy Digital Downloads and Patchstack's track record of confirming WordPress plugin authorization flaws, this should be treated as a near-term patching priority even without confirmed in-the-wild exploitation; absence of an explicit fixed-version statement in the available data is a notable gap that should be verified against the vendor advisory.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable EDD endpoint (e.g., an admin-ajax.php action or REST route lacking a capability check) on a public WordPress site and triggers a state-changing operation - such as modifying plugin settings, discount codes, or order/download records - without ever logging in. Because the CVSS impact is integrity-only (C:N/I:H/A:N), realistic abuse involves tampering with EDD-managed data (pricing, product files, license keys) rather than reading customer data or taking the site offline, and could be scripted at scale against any WordPress site running EDD ≤ 3.6.5.