MEDIUM 4.3 NVD

CVE-2026-105194

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level acces

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.

References

https://wpscan.com/vulnerability/aa49b193-8409-436f-a034-70b166afc483/

Published: 2026-10-08 · Source: NVD · Feed updated: 2026-10-12

This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-10-08 via NVD.

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.