Sell Downloads CVE-2026-94590

Target must be a WordPress site with the CodePeople2 Sell Downloads plugin installed and active at a version from unknown (n/a) up to and including 1.2.3. The flaw stems from the plugin not properly verifying the source/origin of an incoming communication channel (CWE-940), enabling abuse of trusted credentials, so exploitation does not require valid authentication (PR:N) or user interaction (UI:N) per the CVSS vector. The principal limiting factor is deployment scope rather than configuration: only sites with this specific, low-prevalence plugin enabled are affected, and impact is bounded to limited confidentiality/integrity exposure (likely download, order, or file-access metadata) with no availability effect.

This is a moderate-risk, low-priority issue rather than an urgent threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which on paper is attractive to attackers; however, impact is capped at C:L/I:L/A:N (partial confidentiality and integrity, no availability impact), consistent with CWE-940 (Improper Verification of Source of a Communication Channel) and the Patchstack classification of broken access control / information disclosure. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. No conflicting signals are present between the CVSS vector and the description - both point to a remotely reachable access-control weakness. The dominant risk-limiting factor is the product itself: Sell Downloads is a low-footprint WordPress plugin, so even though exploitation is technically easy, the real-world exposure is narrow and this should be patched on a routine cycle rather than treated as an emergency.

A remote attacker sends a crafted HTTP request to a WordPress site running the Sell Downloads plugin (≤1.2.3) that the plugin fails to properly validate the source of, abusing trusted-credential handling to bypass access controls and retrieve or alter protected download/order information. No public exploit code was identified, and the low attack complexity means a working request could be developed with modest effort. Because no authentication or user interaction is required, exploitation can be fully automated against exposed instances.