Description

Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.7.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-06T09:17:55.627Z",
  "pubdate": "2026-10-06T09:17:55.627Z",
  "executiveSummary": "Easy Digital Downloads versions 3.7.1 and below contain a critical broken access control vulnerability. This flaw permits unauthenticated remote attackers to bypass security restrictions, potentially leading to unauthorized data access or manipulation within the plugin environment.\nThe vulnerability resides in the core access control logic, allowing non-privileged entities to perform actions typically reserved for authenticated users or administrators. This poses a significant security risk, as it circumvents the intended authentication and authorization workflows established by the plugin. Attackers do not require valid user accounts to exploit this flaw, making it highly accessible for automated exploitation or targeted attacks.\nThe impact includes the potential for unauthorized exposure of sensitive customer data, system configuration changes, or the manipulation of digital product delivery mechanisms. Organizations utilizing affected versions are at high risk of unauthorized data retrieval. Immediate remediation is required to restore access control integrity and prevent exploitation.",
  "technicalDetails": "The vulnerability stems from an insufficient validation of authorization tokens and user permissions within the request handling process of Easy Digital Downloads <= 3.7.1. Specifically, the implementation fails to verify the authentication status of the requester before processing requests that interface with core administrative or user-specific functionality.\nThe root cause is identified as an Improper Authorization flaw, categorized under CWE-285 or CWE-862, where the application logic assumes that certain endpoints or API routes are inherently protected by higher-level framework hooks that are not correctly triggered in this specific version branch. Consequently, an attacker can dispatch crafted HTTP requests targeting these vulnerable endpoints without providing valid session cookies or authorization headers.\nThe attack flow proceeds as follows: An attacker identifies an exposed endpoint that performs state-changing or data-fetching operations. By observing the request structure and the corresponding plugin function handlers, the attacker constructs a request that omits authentication metadata while including the required parameters for the target function. Because the input validation routine skips the check for a valid current_user or capability-based authorization, the backend processes the request as if it originated from a privileged context.\nThis vulnerability is reachable via standard web protocols (HTTP/HTTPS) and does not necessitate specific network positioning beyond reachability of the WordPress site. The payload behavior involves the manipulation of request parameters to force the plugin to execute functions that return private data or modify database entries related to orders, customers, or plugin configurations.\nPost-exploitation impact varies depending on the specific endpoint being targeted. In scenarios where sensitive information retrieval is possible, attackers may harvest customer personally identifiable information (PII). In scenarios where state-changing endpoints are exposed, attackers might modify purchase records or inject malicious configurations, leading to a complete compromise of the Easy Digital Downloads component. The failure to enforce secure access control represents a breakdown in the plugin's security boundary, granting an unauthorized actor the permissions equivalent to an authenticated user or administrator."
}