CVE-2026-105194 in Easy Digital Downloads Plugin
Summary
by MITRE • 10/08/2026
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Easy Digital Downloads versions prior to 3.7.1 represents a critical failure in server-side authorization controls within the WordPress plugin ecosystem. This flaw specifically affects the block-based editor interface used for managing digital products and their associated metadata. The core technical deficiency lies in the backend logic responsible for retrieving and rendering order data blocks, which fails to validate that the requesting user possesses administrative privileges or ownership of the specific data being accessed. Instead of enforcing strict access control lists based on the authenticated session's role and capabilities, the application relies on client-side restrictions or lacks sufficient server-side verification when processing requests related to recent orders. This architectural oversight allows any authenticated user with even the most basic subscriber-level permissions to bypass intended privacy boundaries and interact directly with administrative data structures that should remain isolated from standard end-users.
From a technical perspective, this issue is classified under CWE-284 Improper Access Control, as it involves an attacker exploiting insufficient restrictions on access controls applied to sensitive information. The vulnerability enables unauthorized disclosure of personally identifiable information and commercial secrets by allowing subscribers to view the recent order history of other customers. This includes specific details such as purchased products, transaction timestamps, and potentially customer names or email addresses depending on configuration settings. More critically, the flaw extends beyond mere data visibility; it grants access to signed download links associated with those orders. These cryptographic signatures are designed to provide secure, time-limited access to paid digital files without requiring repeated authentication checks at the point of download. By obtaining these valid tokens through unauthorized means, an attacker can bypass payment gateways and licensing mechanisms entirely.
The operational impact of this vulnerability is severe for both plugin administrators and their customer base. For site owners, it constitutes a direct breach of data privacy regulations such as GDPR or CCPA due to the exposure of other users' purchase histories and personal details. It also undermines the integrity of the digital commerce model by allowing free access to premium content that was intended to be sold exclusively. This can lead to significant revenue loss and reputational damage, particularly for businesses relying on this plugin for their primary income stream. For end-users, it represents a violation of trust and privacy, as their purchasing habits and acquired assets are exposed to unauthorized parties within the same WordPress installation environment. The ability to obtain signed download links means that once an attacker identifies a target's purchase, they can distribute or resell those files without detection by standard security logging mechanisms designed for payment processing failures rather than data exfiltration via legitimate endpoints.
In terms of threat modeling and attack classification, this vulnerability aligns with ATT&CK technique T1078 Valid Accounts, where an attacker uses existing credentials to access resources they are not authorized to view. It also relates to T1530 Data from Cloud Storage Object or Database Exfiltration if the downloaded files contain sensitive intellectual property. The exploitation path is relatively straightforward for any authenticated user on a vulnerable site, requiring no complex payload construction or privilege escalation beyond their existing low-level account status. This simplicity increases the likelihood of widespread automated scanning and exploitation across WordPress installations that have not yet applied the necessary patches.
To mitigate this risk, immediate action must be taken to update the Easy Digital Downloads plugin to version 3.7.1 or later, where these authorization checks have been corrected to enforce proper server-side validation for all order-related data retrieval operations. Administrators should also audit user roles and permissions within their WordPress environment to ensure that subscriber accounts do not possess unnecessary capabilities related to administrative functions. Implementing additional web application firewall rules can provide a temporary layer of defense by monitoring for unusual patterns in requests targeting order endpoints, although this is not a substitute for patching the underlying code vulnerability. Regular security audits and penetration testing focused on access control mechanisms are recommended to identify similar flaws in other plugins or custom integrations that may share the same architectural weaknesses regarding data isolation between user roles.