What is the CVSS score of CVE-2026-59524?

CVE-2026-59524 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Easy Digital Downloads CVE-2026-59524

EUVD-2026-48190 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-23 Patchstack

GHSA-qm9v-4j55-rxh2

WordPress Information Disclosure Easy Digital Downloads Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

7.3 HIGH

Patchstack Information Disclosure tag warrants C:L over the reported C:N; AV:N/PR:N confirmed by unauthenticated network-accessible broken authentication with no interaction needed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:08 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.

AnalysisAI

Broken authentication in Easy Digital Downloads WordPress plugin (versions ≤ 3.6.7) by Sandhills Development LLC allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), producing limited integrity and availability impact. The attack requires no credentials or user interaction over the network, earning a CVSS 6.5 Medium score - though Patchstack's 'Information Disclosure' tag introduces a potential confidentiality dimension not reflected in the base CVSS C:N designation, suggesting real impact may be slightly higher than the score implies. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Easy Digital Downloads (CPE: cpe:2.3:a:sandhills_development,_llc:easy_digital_downloads) is a WordPress plugin by Sandhills Development LLC providing a complete digital commerce framework for selling files, software, and other digital goods. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), a class of flaw where a secondary code path - commonly an unprotected admin-ajax.php handler, a REST API route registered without a proper permission callback, or a nonce-exempt AJAX action - circumvents the primary authentication gate. In WordPress plugin contexts, this typically arises when developers protect the primary UI-facing route but omit equivalent checks on API or background endpoints that share the same underlying functionality. The specific alternate path is not disclosed in available data.

RemediationAI

Update Easy Digital Downloads to a version newer than 3.6.7 via the WordPress Admin dashboard under Plugins > Installed Plugins > Update, or by manually replacing the plugin files with the latest release from the Sandhills Development site; the exact patched version number is not independently confirmed from available data and must be verified at the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-6-7-broken-authentication-vulnerability) or the official WordPress plugin repository. If immediate upgrade is not feasible, deploying a virtual patch via the Patchstack Security plugin or Wordfence WAF can block exploitation of the alternate authentication path without modifying plugin code, with minimal functional side effects. Alternatively, restricting access to WordPress AJAX and REST API endpoints at the web server or firewall level for unauthenticated users will reduce the attack surface, but may break legitimate storefront functionality such as cart operations and download delivery - test thoroughly before applying. Enable WordPress access logging and monitor for anomalous unauthenticated POST requests to wp-admin/admin-ajax.php or /wp-json/ endpoints as a detection compensating control.