3.7
Low
CVE-2024-9654 The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4
Description
The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verify_guest_email' function to ensure the requesting user is the intended recipient of the purchase receipt. This makes it possible for unauthenticated attackers to bypass intended security restrictions and view the receipts of other users, which contains a link to download paid content. Successful exploitation requires knowledge of another customers email address as well as the file ID of the content they purchased.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy 3.1 | 3.1 → 3.3.4 | No fix stated |
Other CVEs of Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
The 17 CVEs of Easy Digital Downloads – eCommerce Payments and Subscriptions made easy →
CVE-2026-120538
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator…
8.1
High
CVE-2026-14335
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored…
7.2
High
CVE-2026-12476
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including…
7.2
High
CVE-2026-7533
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and…
4.3
Medium