CVE-2026-66476
MediumCVSS 4.9Summary
Administrator Arbitrary File Deletion in Easy Digital Downloads versions up to 3.6.9.
Risk Assessment
An administrator can delete critical system files, potentially leading to complete data loss or system integrity compromise.
Recommendation
Update the Easy Digital Downloads plugin to the latest patched version.
Other vulnerabilities in Easy Digital Downloads
See all- CVE-2026-59524Medium
Easy Digital Downloads plugin version 3.6.7 and earlier contains a broken authentication vulnerability that does not require authentication. An attacker can gain unauthorized access to administrative functions.
- CVE-2026-12476High
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.
- CVE-2026-39503High
Easy Digital Downloads versions up to 3.6.5 have a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.