CVE-2026-12476 is an arbitrary file upload vulnerability in the Easy Digital Downloads WordPress plugin (up to version 3.6.9). The vulnerability exists in the edd_do_ajax_import_file_upload() function, which inadequately validates the uploaded file's type by relying solely on the client-supplied Content-Type header. It then moves the uploaded file directly into a web-accessible directory without proper sanitization or MIME type enforcement, allowing authenticated users with Shop Manager privileges or higher to upload arbitrary files. This can lead to remote code execution on the affected server.

An attacker with Shop Manager-level access or higher can upload arbitrary files to the server, potentially enabling remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Shop Manager and higher privileges to trusted users only. Monitor for updates from the vendor or plugin maintainers and apply patches promptly once released.