CVE-2026-105194: CWE-200 Information Exposure in Easy Digital Downloads
Description
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
CVSS v3.1
Score 4.3medium
Affected software
Easy Digital Downloads
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-105194 is an information exposure vulnerability (CWE-200) in the Easy Digital Downloads WordPress plugin prior to version 3.7.1. The plugin fails to restrict order data visibility to the current user, enabling subscriber-level users to view other customers' recent order products and obtain signed download links. These signed links grant access to paid digital content without requiring a purchase, potentially leading to unauthorized distribution of paid files.
Potential Impact
Unauthorized users with subscriber-level access can view sensitive order information of other customers and access paid digital downloads without payment. This compromises customer privacy and results in potential revenue loss for merchants using the plugin.
Mitigation Recommendations
Upgrade Easy Digital Downloads to version 3.7.1 or later, where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the version boundary provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-04T11:56:00.085Z
- State
- PUBLISHED
Threat ID: 6ac735da2cdf04f656f03ea2
Added to database: 10/08/2026, 06:19:06 UTC
Last enriched: 10/08/2026, 06:34:11 UTC
Last updated: 10/08/2026, 18:48:43 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.