4.3
Medium
CVE-2026-105194 The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user,…
Description
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Easy Digital Downloads 3.7 | earliest → < 3.7.1 | 3.7.1 |
Other CVEs of Easy Digital Downloads
The 4 CVEs of Easy Digital Downloads →
CVE-2026-105190
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before…
5.3
Medium
CVE-2023-0380
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before…
5.4
Medium
CVE-2022-3600
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which…
9.8
Critical