WordPress Plugin Vulnerabilities

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.7.1.1 - Missing Authorization

Description

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.7.1. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
easy-digital-downloads
Fixed in 3.7.1.1

References

CVE
CVE-2026-42638
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0bdf8765-1774-4d05-892a-055a06104e87

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
313610dc-d503-4f21-99a1-3714a3a5cceb

Timeline

Publicly Published
2026-10-05 (about 11 days ago)
Added
2026-10-09 (about 8 days ago)
Last Updated
2026-10-09 (about 8 days ago)

Other

Published
Title
Published
2024-03-12
Title
Tutor LMS – eLearning and online course solution < 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Published
2026-09-08
Title
ilGhera Reviso Exporter for WooCommerce < 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function
Published
2025-03-14
Title
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
Published
2026-01-25
Title
Bannerize Pro < 1.11.1 - Missing Authorization
Published
2024-12-11
Title
ListApp Mobile Manager <= 1.7.7 - Missing Authorization to Privilege Escalation