CVE-2026-6798 is a missing authorization vulnerability (CWE-862) in the 2Download Connector for 2DL Hosted Checkout WordPress plugin. All versions up to and including 0.1.5 are affected. The plugin fails to verify that a user is authorized to perform certain actions, enabling unauthenticated attackers to view sensitive subscription data of other customers. This includes subscription status, product names, order IDs, purchase dates, and expiry dates. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

An unauthenticated attacker can access sensitive subscription-related information of arbitrary customers, including subscription status, product names, order IDs, purchase dates, and expiry dates. This exposure can lead to privacy violations and potential information disclosure but does not impact integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin or disable it if possible to prevent unauthorized data exposure.