CVE-2026-59524
MediumCVSS 6.5Summary
Easy Digital Downloads plugin version 3.6.7 and earlier contains a broken authentication vulnerability that does not require authentication. An attacker can gain unauthorized access to administrative functions.
Risk Assessment
The organization is at risk of administrator account takeover and theft of customer data and digital products.
Recommendation
Immediately update the Easy Digital Downloads plugin to the latest available version.
Other vulnerabilities in Easy Digital Downloads
See all- CVE-2026-66476Medium
Administrator Arbitrary File Deletion in Easy Digital Downloads versions up to 3.6.9.
- CVE-2026-12476High
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.
- CVE-2026-39503High
Easy Digital Downloads versions up to 3.6.5 have a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.