CVE-2026-95522
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Easy Digital Downloads plugin in versions up to and including 3.7.0 contains an SQL Injection vulnerability accessible to users with the Shop manager role. This allows injection of malicious SQL code into database queries.
Risk Assessment
A user with Shop manager privileges could exploit this flaw to read or modify store data, potentially leading to leakage of customer or order data.
Recommendation
Update the Easy Digital Downloads plugin to a version newer than 3.7.0 or restrict Shop manager account privileges.
Other vulnerabilities in Easy Digital Downloads
See all- CVE-2026-66476Medium
Administrator Arbitrary File Deletion in Easy Digital Downloads versions up to 3.6.9.
- CVE-2026-59524Medium
Easy Digital Downloads plugin version 3.6.7 and earlier contains a broken authentication vulnerability that does not require authentication. An attacker can gain unauthorized access to administrative functions.
- CVE-2026-12476High
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.
- CVE-2026-39503High
Easy Digital Downloads versions up to 3.6.5 have a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS