EUVD-2026-85491
GHSA-m24x-544x-prhx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or hijack Shop Manager account
-
DeliveryAccess vulnerable EDD admin function
-
ExploitInject SQL via unsanitized parameter
-
ExecutionExtract database records (C:H)
-
ImpactHarvest credentials and customer PII
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with the Shop Manager role (or higher) on a site running Easy Digital Downloads ≤3.7.0 - PR:H per the CVSS vector confirms this is not exploitable by anonymous or low-privilege visitors. The attacker reaches the vulnerable admin-side function over the network (AV:N) with no user interaction (UI:N) and low complexity (AC:L). The practical limiting factors are the need to already possess or compromise a trusted Shop Manager credential and the plugin being installed and active; there is no default-configuration unauthenticated path. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, base 7.6, reported by Patchstack) describes a network-reachable, low-complexity SQL injection that nonetheless requires high privileges (PR:H) - specifically a WordPress Shop Manager account, per the description. That authentication barrier is the dominant risk-limiting factor: this is not an unauthenticated internet-facing bug but a post-authentication privilege-abuse issue where an already-trusted store operator (or a hijacked Shop Manager session) can read database contents (C:H) beyond their intended remit. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, and Patchstack advisories of this class rarely ship exploit code, so exploitation status is 'no public exploit identified at time of analysis' - a real but bounded issue rather than a mass-exploitation priority. Two signals warrant scrutiny: the vendor sets S:C (scope change) which is aggressive for a typical SQLi that stays within the WordPress database boundary (S:U is more defensible), and I:N/A:L implies read-only impact yet the 7.6 score is inflated by the S:C and C:H combination - treat the effective severity as medium given the PR:H gate. No fix version is provided in the input, which is a gap for remediation planning. |
| Exploit ScenarioDerived | An authenticated WordPress user holding the Shop Manager role (a delegated e-commerce operator, or an attacker who has phished/hijacked such an account) submits crafted input to an Easy Digital Downloads admin function that concatenates it into a SQL query. The injection returns arbitrary database rows - customer PII, order data, password hashes, and secret keys - enabling escalation toward full site compromise. No public exploit code is identified in the supplied intelligence, and exploitation requires the pre-existing high-privilege account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
SQL injection in the Easy Digital Downloads WordPress plugin through version 3.7.0 lets an authenticated account with the Shop Manager role or higher inject arbitrary SQL into an admin-side database query reachable over the network, exposing sensitive stored data such as customer records, order and payment metadata, and user password hashes, while requiring no victim interaction. The real-world barrier is the credential requirement noted in the assessed vector (PR:H), so this is chiefly a compromised- or over-privileged-account and insider risk rather than an anonymous mass-exploitation path; confidentiality impact is high, integrity impact is none, and availability impact is low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was included in the source reporting, so exploitation signal remains limited to the advisory disclosure by Patchstack.
RemediationAI
No vendor-released patch could be identified at time of analysis and no fixed version number is stated in the supplied data, so the first step is to check the vendor's plugin page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-7-0-sql-injection-vulnerability?_s_id=cve) for a release above 3.7.0 and apply it as soon as it is published; because the reported boundary is "≤3.7.0", any later tagged release is the expected fix, but that must be verified against the vendor rather than assumed. Until a fixed release is applied, treat the plugin's admin surface as untrusted: audit every account holding the Shop Manager role or any higher WordPress role, remove or downgrade accounts that do not need store administration, rotate passwords for the remaining accounts, and enforce strong authentication (MFA via a separate plugin) so that a stolen Shop Manager credential cannot be used to reach the vulnerable admin function - the trade-off is operational friction for legitimate store staff and possible breakage of integrations that rely on those accounts. If the store does not need the plugin, deactivating and deleting it removes the exposure entirely, at the cost of losing storefront functionality. If the plugin must stay live, restrict access to wp-admin and admin-ajax.php/REST admin routes by IP allowlist or VPN where feasible, and deploy WAF rules that flag SQL metacharacter patterns in authenticated admin requests; be aware that admin-side WAF filtering is prone to false positives against legitimate plugin traffic, so rules should be monitored in log-only mode before enforcement. Logging and alerting on anomalous database-read volume from authenticated admin sessions provides a detection backstop given that the impact is read-only data exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), i.e. classic SQL injection, inside the Easy Digital Downloads WordPress plugin, a widely deployed e-commerce/download-store extension that registers its own custom roles and capabilities - including the Shop Manager role referenced in the advisory - and exposes privileged admin-side AJAX/REST endpoints for store administration. Because the vulnerable query sits behind an admin-side function, the assessed vector is network-reachable with low complexity and no user interaction (AV:N/AC:L/UI:N) but gated on high privileges (PR:H), which is why the score lands at 7.6 rather than in the unauthenticated-critical band. The CPE cpe:2.3:a:syed_balkhi:easy_digital_downloads:*:*:*:*:*:*:*:* is wildcarded and does not itself constrain a version range; the effective range of ≤3.7.0 comes from the EUVD entry and the advisory title. Note that the source-reported vector lists scope as changed (S:C) whereas our independent assessment scores it S:U, so the injected query is treated as impacting the plugin's own database context rather than escalating the security authority of other components. Impact is dominated by confidentiality (C:H) - read-oriented extraction of database contents - with no integrity effect and only low availability effect.
Know when Easy Digital Downloads gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
PR:H reflects the required Shop Manager role; I keep C:H/I:N/A:L from the read-only SQLi but downgrade the vendor's S:C to S:U since the injection stays within the WordPress database boundary.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Executive ViewAI
Easy Digital Downloads, a WordPress e-commerce plugin used to sell digital products, carries an unpatched SQL injection flaw in all versions through 3.7.0 that lets a Shop Manager-level account or higher pull customer records, order and payment metadata, and password hashes from the store database without any victim action. Because the flaw requires an authenticated privileged account rather than being exploitable anonymously at scale, the realistic threat is insider misuse or an attacker operating with compromised store credentials. Leadership should treat this as a data-breach exposure risk: a single over-privileged or stolen account can reach the full customer and payment data set, with regulatory notification and reputational consequences, and no vendor fix is yet available.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least privilege by minimizing and auditing Shop Manager and Administrator accounts, rotate credentials and require MFA, restrict wp-admin and REST access to trusted networks, deploy WAF virtual-patching rules targeting SQL injection on admin-side Easy Digital Downloads requests, enable database activity monitoring and alerting for anomalous reads of customer, order, and payment tables, and review logs for signs of credential compromise or unauthorized data extraction.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Easy Digital Downloads
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downl
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Rated critical severity (CVSS 9.8)
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which c
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before
Unauthenticated attackers can bypass disabled user registration in Easy Digital Downloads WordPress plugin versions befo
Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Se
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history,
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes
Exploit-DB