Description

The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.

Related CPE's

Could not find any relations

References

https://wpscan.com/vulnerability/d167e184-af71-4ff8-8a2d-a665f7539fe4/

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-862

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.3 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-08T11:16:44.607Z

21 hours ago

Last modified

2026-10-08T20:51:18.123Z

12 hours ago