The Easy Digital Downloads plugin for WordPress contains an unvalidated redirect vulnerability in all versions up to 3.6.2. This occurs because the plugin does not properly validate the URL provided through the 'edd_redirect' parameter. An attacker can exploit this by crafting a password reset email link that redirects users to arbitrary external sites, potentially leading to phishing or other malicious activities. The vulnerability is classified as CWE-640, reflecting weaknesses in the password recovery process. The CVSS 3.1 base score is 4.3, indicating medium severity with network attack vector, low complexity, no privileges required, user interaction needed, and limited impact to integrity.

The vulnerability allows unauthenticated attackers to redirect users who click on password reset email links to potentially malicious websites. This could facilitate phishing attacks or other social engineering tactics. There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been identified.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with password reset emails and verify URLs before clicking. Monitoring for updates from the plugin vendor is recommended.