CVE-2026-95522: WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
Published Sep 23, 2026
·Updated
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Affected Software
1 affected component
WordPress Easy Digital Downloads<=3.7.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Easy Digital Downloads pluginto a version that resolves this vulnerability.Fixed in 3.7.1
Event History
Sep 23, 2026
CVE Published
via MITRE·06:14 PM
Data Sourced
via MITRE·06:14 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability requires shop manager privileges. It is not described as exploitable by unauthenticated or low-privileged users.
2
Are all Easy Digital Downloads installations affected by default?
The affected scope is Easy Digital Downloads versions 3.7.0 and earlier. The provided information does not identify any configuration prerequisite beyond an attacker having shop manager access.
3
What is the potential impact of successful exploitation?
Successful exploitation may allow SQL injection, with high confidentiality impact and low availability impact. The vulnerability is rated high severity with a CVSS score of 7.6.