Easy Digital Downloads: Subscriber access to paid files through other users orders
A Subscriber or higher can view a block's order data that is not restricted to the current user. The output includes other customers' recent purchased products and signed download links, allowing access to paid digital files without purchase. The useful primitive is the valid signed download link, not a proven ability to forge signatures. The block name, rendering endpoint and selector parameters are not disclosed. Affected versions: < 3.7.1. The authoritative export identifies 3.7.1 as fixed for this CVE.
- Component
- Easy Digital Downloads
- Plugin slug
easy-digital-downloads- Affected
- < 3.7.1
- Safe version
3.7.1- Published
- Oct 08, 2026
This CVE was published Oct 08, 2026 and is one of 72 known issues for this plugin.
Update, patch or deactivate.
Update to 3.7.1 or a later supported release. Application-level remediation: Restrict the order query to the authenticated customer and verify purchase entitlement before exposing or redeeming download links. Avoid sharing user-specific output through public caches and invalidate improperly exposed links where supported.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N