CVE-2026-42638: WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Easy Digital Downloads pluginto a version that resolves this vulnerability.Fixed in 3.7.1.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges to exploit it.
Which installations are affected?
WordPress sites using Easy Digital Downloads version 3.7.1 or earlier are affected according to the provided vulnerability information.
What impact can exploitation have?
The listed CVSS vector indicates high integrity impact, meaning successful exploitation can result in unauthorized modification of affected data or functionality. No confidentiality or availability impact is specified.