CVE-2026-12476
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.
Risk Assessment
An attacker can upload a malicious file (e.g., PHP script) to the server, potentially leading to remote code execution and full site compromise.
Recommendation
Update the plugin to the latest version. Restrict access to the import function to trusted users only.
Other vulnerabilities in Easy Digital Downloads
See all- CVE-2026-66476Medium
Administrator Arbitrary File Deletion in Easy Digital Downloads versions up to 3.6.9.
- CVE-2026-59524Medium
Easy Digital Downloads plugin version 3.6.7 and earlier contains a broken authentication vulnerability that does not require authentication. An attacker can gain unauthorized access to administrative functions.
- CVE-2026-14335High
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 is vulnerable to Stored Cross-Site Scripting (XSS) via PayPal IPN parameters. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-105190Medium
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.
- CVE-2026-105194Medium
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
- CVE-2026-42638High
Missing Authorization vulnerability in Easy Digital Downloads allows exploiting incorrectly configured access control security levels. Affects versions through 3.7.1.
- CVE-2026-95522High
The Easy Digital Downloads plugin in versions up to and including 3.7.0 contains an SQL Injection vulnerability accessible to users with the Shop manager role. This allows injection of malicious SQL code into database queries.
- CVE-2026-39503High
Easy Digital Downloads versions up to 3.6.5 have a vulnerability in access control that allows unauthorized access to resources.
- CVE-2025-11271Medium
The Easy Digital Downloads plugin for WordPress in all versions up to and including 3.5.2 is vulnerable to Order Manipulation due to an order verification bypass. When the POST body includes verification_override=1, verification is unconditionally skipped, allowing an unauthenticated attacker to submit a forged IPN that is treated as verified. A valid PayPal transaction id is required, restricting order manipulation to orders placed by the attacker with a customer account.
Original NVD description (English source)
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS