Description

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.

Related CPE's

Could not find any relations

References

https://wpscan.com/vulnerability/aa49b193-8409-436f-a034-70b166afc483/

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-200

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.3 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-08T06:16:39.763Z

26 hours ago

Last modified

2026-10-08T20:51:18.123Z

12 hours ago