EUVD-2026-93060
GHSA-px8w-mx84-phvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable EDD ≤3.7.1
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitReach endpoint missing authorization check
-
ExecutionPerform unauthorized state-changing action
-
ImpactTamper with plugin/store data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress site running the Easy Digital Downloads plugin at version 3.7.1 or earlier, with the vulnerable endpoint reachable over the network (default for a public WordPress install). Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, elevated privileges, or user interaction are required, so exploitation works against default configurations. The limiting factors are the plugin being installed and active and the version being ≤3.7.1; the exact protected action affected is not detailed in the available data, so the concrete prerequisite is 'EDD ≤3.7.1 installed and network-accessible.' Impact is confined to integrity (C:N/A:N), limiting the realistic blast radius to unauthorized data modification rather than disclosure or denial of service. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, which rightly places the base score at 7.5. However, the impact profile is narrow: C:N/I:H/A:N means the vulnerability affects integrity only - an unauthenticated attacker can modify or write data they should not be able to, but cannot read sensitive data or take the site offline through this flaw directly. No EPSS probability was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The practical priority is therefore moderate-to-high for exposed WordPress sites running the affected plugin: the lack of authentication and the broad reach of WordPress plugin vulnerabilities make opportunistic scanning plausible, but the integrity-only impact and absence of confirmed exploitation argue against treating it as an emergency on par with an actively-exploited RCE. Note the single Patchstack reference does not specify exactly which access-control-protected action (endpoint/AJAX handler) is exposed - verify with the Patchstack advisory to determine what data can actually be altered. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a WordPress site running Easy Digital Downloads 3.7.1 or earlier and sends a crafted HTTP request to a plugin endpoint that fails to verify the caller's authorization (CWE-862). Because no login, privileges, or user interaction are required, the attacker invokes a protected action to modify data or state they should not control. No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated, network-reachable requests can abuse a missing authorization check in the Easy Digital Downloads WordPress plugin (versions up to and including 3.7.1) to perform actions that should require a privileged, logged-in user, giving attackers an integrity-only impact consistent with the 7.5 CVSS 3.1 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Any WordPress site with the plugin installed and active at or below 3.7.1 is in scope, and exploitation requires no credentials, no privileges, and no victim interaction; the trade-off is that no data disclosure or denial of service is expected, so the realistic blast radius is unauthorized modification of site/e-commerce data rather than full compromise. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the specific protected action that is exposed is not detailed in the available intelligence, so affected versions should be treated as unauthorized-write capable until a fix is confirmed.
RemediationAI
No vendor-released patch version is identified in the provided intelligence, so administrators should first check the WordPress plugin directory and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-7-1-broken-access-control-vulnerability?_s_id=cve) for the fixed release and update Easy Digital Downloads as soon as one is published; WordPress-dashboard plugin updates are the standard delivery path, and any available update should be applied rather than deferring to a maintenance window given AV:N/AC:L/PR:N/UI:N. If a patched version is not yet available, the most effective compensating control is to deactivate or remove the plugin until a fix exists if digital-store functionality is not business-critical, accepting the obvious loss of storefront and download-delivery features. For sites that must stay online, place a WAF or reverse-proxy rule in front of the site that blocks anonymous POST/PUT/DELETE traffic to the plugin's REST and admin-ajax.php routes unless the request carries a valid logged-in session or nonce - the trade-off is that legitimate guest-facing flows (guest checkout, payment webhooks, unauthenticated download links) can break, so the rule set must be tuned and monitored before being put in block mode. Additionally, restrict wp-admin and plugin REST namespaces to trusted networks or require an additional authentication layer, and enable logging/alerting on state-changing requests to plugin endpoints so that unauthorized writes are detected quickly; none of these measures fixes the missing capability check, so they should be considered temporary until a vendor update is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Easy Digital Downloads is a WordPress plugin for selling and managing digital products, and it exposes front-end and REST/AJAX-style endpoints that WordPress routes to plugin code for both guests (shoppers, checkout flows, download processing) and authenticated users. The root cause class here is CWE-862, Missing Authorization: the plugin fails to verify that the requester holds the required capability before executing a privileged action, so code intended for shop managers/administrators can be reached by an anonymous visitor. In WordPress, the usual controls are current_user_can() capability checks plus nonce validation on state-changing requests, and a missing-authorization flaw of this type is effectively an authentication bypass for the affected operation - reflected in the reporter tags ('Authentication Bypass') and the CVSS vector's PR:N/UI:N, meaning the request path is open to anonymous, automated traffic. The affected-product data is sparse: the only CPE supplied is cpe:2.3:a:syed_balkhi:easy_digital_downloads:*:*:*:*:*:*:*:* with a wildcard version, so version-based inventory must rely on the advisory's stated upper bound of ≤ 3.7.1 rather than on CPE matching. Because impact is scored I:H with C:N and A:N, the flaw permits unauthorized writes (creating, altering, or triggering state changes) but is not assessed as leaking data or taking the site offline.
Know when Easy Digital Downloads gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network-reachable WordPress plugin endpoint missing authorization (PR:N, AV:N, AC:L); broken access control permits unauthorized data modification, so I:H with C:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.7.1 versions.
Executive ViewAI
Easy Digital Downloads WordPress plugin versions up to and including 3.7.1 contain a missing authorization flaw that lets unauthenticated, network-reachable attackers modify site or e-commerce data without stealing information or causing outages. Because the plugin commonly powers digital storefronts, affected organizations should care about unauthorized changes to orders, pricing, content, and customer trust rather than data disclosure. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating Easy Digital Downloads versions up to and including 3.7.1 where feasible, restricting network access to affected WordPress sites and plugin endpoints, deploying virtual patching or WAF rules to block unauthenticated requests to privileged plugin actions, and monitoring for unauthorized content or order modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Easy Digital Downloads
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downl
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Rated critical severity (CVSS 9.8)
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which c
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before
Unauthenticated attackers can bypass disabled user registration in Easy Digital Downloads WordPress plugin versions befo
Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Se
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history,
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes
Exploit-DB