CVE-2026-105194: Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block

Q: Who can exploit this issue?

Any authenticated WordPress user with subscriber-level access or higher can exploit it. The affected site must use the Easy Digital Downloads User Downloads block and a version before 3.7.1.

Q: What information can an attacker obtain?

An attacker can view other customers' recent order products and obtain signed download links. Those links can provide access to paid digital files without purchasing them.

Q: Are unauthenticated visitors affected?

The available data identifies subscriber-level access as the minimum required privilege. It does not state that unauthenticated visitors can exploit the issue.

Q: How can I determine whether my site is affected?

Check whether the Easy Digital Downloads WordPress plugin is installed at a version earlier than 3.7.1 and whether the User Downloads block is in use. Sites meeting both conditions should treat subscriber accounts as potential exposure points.

Published Oct 8, 2026

Updated

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.

Affected Software

1 affected component

Easy Digital Downloads Easy Digital Downloads WordPress plugin<3.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Easy Digital Downloads to a version that resolves this vulnerability.
Fixed in 3.7.1

Event History

Oct 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with subscriber-level access or higher can exploit it. The affected site must use the Easy Digital Downloads User Downloads block and a version before 3.7.1.

What information can an attacker obtain?

An attacker can view other customers' recent order products and obtain signed download links. Those links can provide access to paid digital files without purchasing them.

Are unauthenticated visitors affected?

The available data identifies subscriber-level access as the minimum required privilege. It does not state that unauthenticated visitors can exploit the issue.

How can I determine whether my site is affected?

Check whether the Easy Digital Downloads WordPress plugin is installed at a version earlier than 3.7.1 and whether the User Downloads block is in use. Sites meeting both conditions should treat subscriber accounts as potential exposure points.

CVE-2026-105194: Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Are unauthenticated visitors affected?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Are unauthenticated visitors affected?

How can I determine whether my site is affected?