CVE-2026-39503
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Easy Digital Downloads versions up to 3.6.5 have a vulnerability in access control that allows unauthorized access to resources.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data, potentially leading to data loss or privacy breaches.
Recommendation
It is recommended to update to the latest version of Easy Digital Downloads to mitigate this vulnerability.
Other vulnerabilities in Easy Digital Downloads
See all- CVE-2026-66476Medium
Administrator Arbitrary File Deletion in Easy Digital Downloads versions up to 3.6.9.
- CVE-2026-59524Medium
Easy Digital Downloads plugin version 3.6.7 and earlier contains a broken authentication vulnerability that does not require authentication. An attacker can gain unauthorized access to administrative functions.
- CVE-2026-12476High
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.
Original NVD description (English source)
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.