EUVD-2026-49251
GHSA-6gc7-m2fp-986q
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Requires admin privileges (PR:H), no user interaction, high availability impact only.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.
AnalysisAI
Arbitrary file deletion vulnerability in Easy Digital Downloads plugin for WordPress versions 3.6.9 and earlier allows authenticated administrators to delete arbitrary files on the server via a path traversal attack. The vulnerability leads to high availability impact (file deletion) but requires high privileges, limiting exploitability to admin users. No public exploit or active exploitation has been identified at the time of analysis.
Technical ContextAI
Easy Digital Downloads is a popular WordPress plugin for selling digital products. The vulnerability is a path traversal (CWE-22) in the file deletion functionality, likely triggered by unsanitized user input in file paths. The CPE indicates all versions up to and including 3.6.9 are affected. The vulnerability requires administrator-level access to the WordPress admin panel, which reduces the attack surface but still poses a risk for site availability if an admin account is compromised.
RemediationAI
Upgrade Easy Digital Downloads to version 3.6.10 or later, which includes a fix for this vulnerability. As a workaround, limit administrator account access to trusted users and regularly audit file permissions. If immediate upgrade is not possible, consider disabling the file deletion feature or implementing a web application firewall rule to block path traversal patterns. The vendor advisory provides no manual patch; only the plugin update is recommended.
More in Easy Digital Downloads
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downl
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Rated critical severity (CVSS 9.8)
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which c
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before
Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Se
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history,
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes
Unauthenticated broken access control in the Easy Digital Downloads WordPress plugin (versions <= 3.6.5) allows remote a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today