What is the CVSS score of CVE-2026-39503?

CVE-2026-39503 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Easy Digital Downloads are affected by CVE-2026-39503?

Easy Digital Downloads WordPress plugin versions 3.6.5 and earlier contain an unauthenticated access control vulnerability enabling remote attackers to invoke privileged plugin functions and modify…

How to fix or mitigate CVE-2026-39503?

Within 24 hours: inventory WordPress installations running Easy Digital Downloads and document current versions; audit plugin and database activity logs for suspicious privileged function calls. Within 7 days: determine whether affected sites can operate without the plugin, or update to the latest available version beyond 3.6.5; implement network restrictions on WordPress administrative interfaces. Within 30 days: monitor the plugin vendor for a patched release and deploy immediately upon availability; confirm remediation through security testing.

Easy Digital Downloads CVE-2026-39503

EUVD-2026-36948 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-2pxh-c3p8-9w89

Authentication Bypass Easy Digital Downloads

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable WordPress endpoint missing an authorization check (PR:N, AV:N, AC:L, UI:N); integrity-only impact per CWE-862 broken access control, no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:24 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.

AnalysisAI

Unauthenticated broken access control in the Easy Digital Downloads WordPress plugin (versions <= 3.6.5) allows remote attackers to invoke privileged plugin functions without authentication, leading to unauthorized modification of plugin data. The flaw stems from a missing authorization check (CWE-862) and primarily impacts integrity of the affected WordPress sites. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Easy Digital Downloads (EDD) is a popular AwesomeMotive WordPress plugin used to sell digital goods (software, e-books, music) on self-hosted WordPress sites, identified by CPE cpe:2.3:a:awesomemotive:easy_digital_downloads. The vulnerability is classified as CWE-862 (Missing Authorization), meaning a sensitive plugin action or endpoint executes without verifying the caller's permissions or capability (e.g., a wp-admin-ajax handler, REST route, or admin-post hook lacking a current_user_can() or nonce check). Because WordPress plugins commonly expose actions via admin-ajax.php and the REST API, missing authorization on such handlers turns them into network-reachable, unauthenticated entry points against any site running the vulnerable version.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should consult the Patchstack page at https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-6-5-broken-access-control-vulnerability and the WordPress.org plugin page to install the next release above 3.6.5 as soon as it is published. Until the site is upgraded, restrict access to /wp-admin/admin-ajax.php and the EDD REST namespace (/wp-json/edd-api/ and /wp-json/edd/) from untrusted networks via the web server or a WAF, or temporarily deactivate the plugin on stores that can tolerate downtime - noting that blocking admin-ajax.php breaks legitimate front-end AJAX features (cart, checkout, login forms) and that deactivation will take the storefront offline. If using Patchstack, Wordfence, or a comparable virtual-patching service, enable the corresponding vPatch/rule for CVE-2026-39503 as an interim compensating control.