4.3
Moyenne
CVE-2026-105194 The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user,…
Description
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Easy Digital Downloads 3.7 | premières → < 3.7.1 | 3.7.1 |
Autres CVE de Easy Digital Downloads
Les 4 CVE de Easy Digital Downloads →
CVE-2026-105190
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before…
5.3
Moyenne
CVE-2023-0380
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before…
5.4
Moyenne
CVE-2022-3600
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which…
9.8
Critique