CVE-2026-12476 in Easy Digital Downloads Plugin
Summary
by MITRE • 07/29/2026
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/29/2026
The Easy Digital Downloads plugin for WordPress presents a critical security vulnerability classified as arbitrary file upload in versions up to and including 3.6.9. This flaw exists within the edd_do_ajax_import_file_upload() function where the plugin fails to implement robust file validation mechanisms. The vulnerability stems from insufficient input sanitization that relies solely on client-supplied Content-Type headers for mime type verification, creating a significant attack surface for malicious actors who possess Shop Manager privileges or higher access levels.
The technical implementation of this vulnerability demonstrates a fundamental flaw in the plugin's security architecture where the system performs only basic mime type checking against a limited allow-list of CSV content types while completely bypassing WordPress core file validation mechanisms. When an authenticated attacker with appropriate privileges uploads a file, the system accepts the Content-Type header provided by the client without proper server-side verification. The plugin then uses the raw move_uploaded_file() function to transfer the uploaded file to the wp-content/uploads/edd/exports/ directory maintaining the original filename and extension, effectively allowing attackers to execute arbitrary code through malicious file uploads.
This vulnerability creates substantial operational impact as it enables authenticated attackers with Shop Manager-level permissions or higher to escalate their privileges and potentially gain full control over the affected WordPress installation. The exploitation pathway allows for remote code execution since attackers can upload web shells, malicious scripts, or other harmful payloads that persist on the server. This represents a severe security risk that undermines the integrity of the entire WordPress ecosystem, particularly when considering that Shop Manager roles typically have access to administrative functions within the plugin's interface.
The vulnerability aligns with CWE-434 which specifically addresses insecure file upload vulnerabilities where applications accept files from untrusted sources without proper validation and sanitization. From an adversarial perspective, this flaw maps directly to ATT&CK technique T1190 which involves exploitation of vulnerabilities in web applications to achieve persistent access and remote code execution capabilities. Organizations using affected plugin versions face significant risk of data breaches, service disruption, and potential compromise of entire WordPress installations. The remediation approach requires immediate patching to the latest plugin version that addresses the file validation logic and implements proper MIME type enforcement through WordPress core upload handling functions.
Security practitioners should implement additional defensive measures including restricting file upload capabilities in web server configurations, monitoring for unusual file upload patterns in access logs, and implementing network-based intrusion detection systems to identify potential exploitation attempts. The vulnerability highlights the importance of proper input validation and server-side security controls that cannot be bypassed by client-supplied information, emphasizing the need for comprehensive security testing and validation of all file handling operations within web applications.