Digital Download EUVD-2026-11885

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates a moderate-to-low severity with favorable exploitation conditions: network-based attack requiring no user interaction, no privileges, and low complexity. However, the impact is restricted to integrity (partial data modification only), with no confidentiality or availability impact, constraining real-world damage potential. Without KEV status or confirmed POC availability data, and absent EPSS score information, the actual exploitation likelihood cannot be definitively assessed against empirical threat data. The combination of a low CVSS impact score (5.3 is below the common 7.0 threshold) and authorization-only impact suggests this is a real but contained priority—organizations should patch during normal maintenance cycles rather than treat as critical incident response. The network attack vector and lack of authentication requirements do elevate concern in environments where the plugin is exposed to untrusted users.

An unauthenticated attacker discovers the WordPress site is running Digital Download version 1.1.4 and identifies an unprotected endpoint or AJAX handler (such as a download modification or product update function) that lacks authorization checks. The attacker sends a crafted request directly to this endpoint over the network without providing valid credentials, successfully modifying download metadata, product descriptions, or related data fields. This could allow the attacker to redirect download links to malicious files, modify pricing information, or corrupt product records—all without authentication due to the missing authorization control.