Easy Digital Downloads CVE-2026-66476

The attacker must have administrator-level access to the WordPress site (authenticated as admin). The plugin version must be Easy Digital Downloads <= 3.6.9. The vulnerability is triggered through a file deletion feature that fails to properly sanitize input paths, allowing traversal outside intended directories. The attack requires no user interaction and can be performed over the network. Limiting factors: only users with admin roles can exploit; no unauthenticated access possible.

CVSS 3.1 base score 4.9 (medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The high privileges required (PR:H) significantly reduce the likelihood of exploitation by external attackers. No EPSS score, KEV listing, or public exploit code has been reported, indicating low real-world exploitation risk. However, if an administrator account is compromised, the attacker could delete essential files, causing denial of service or data loss. The risk is moderate and context-dependent, primarily a concern for sites with weak admin password policies or insider threats.

An attacker who has obtained administrator credentials (e.g., through phishing or credential stuffing) logs into the WordPress admin panel and navigates to a vulnerable file deletion feature. By manipulating the file path parameter, the attacker deletes critical system files such as wp-config.php, rendering the site inaccessible and causing data loss. No public exploit code is known, but the attack is straightforward for anyone with admin access.