CVE-2026-105194: Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Easy Digital Downloadsto a version that resolves this vulnerability.Fixed in 3.7.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with subscriber-level access or higher can exploit it. The affected site must use the Easy Digital Downloads User Downloads block and a version before 3.7.1.
What information can an attacker obtain?
An attacker can view other customers' recent order products and obtain signed download links. Those links can provide access to paid digital files without purchasing them.
Are unauthenticated visitors affected?
The available data identifies subscriber-level access as the minimum required privilege. It does not state that unauthenticated visitors can exploit the issue.
How can I determine whether my site is affected?
Check whether the Easy Digital Downloads WordPress plugin is installed at a version earlier than 3.7.1 and whether the User Downloads block is in use. Sites meeting both conditions should treat subscriber accounts as potential exposure points.