Easy Digital Downloads vulnerabilities
4 known CVE vulnerabilities in Easy Digital Downloads, translated and rated.
- CVE-2026-66476Medium
Administrator Arbitrary File Deletion in Easy Digital Downloads versions up to 3.6.9.
- CVE-2026-59524Medium
Easy Digital Downloads plugin version 3.6.7 and earlier contains a broken authentication vulnerability that does not require authentication. An attacker can gain unauthorized access to administrative functions.
- CVE-2026-12476High
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.
- CVE-2026-39503High
Easy Digital Downloads versions up to 3.6.5 have a vulnerability in access control that allows unauthorized access to resources.