CVE-2026-105194 Easy Digital Downloads CVE debrief

Who should care

Defenders responsible for WordPress installations with Easy Digital Downloads plugin versions older than 3.7.1 should assess exposure and verify patching to prevent sensitive information disclosure. This includes reviewing the current plugin version, restricting access to sensitive order data and download links, and monitoring for suspicious activity related to digital file downloads.

Why it matters

CVE-2026-105194 allows users with subscriber-level access to view other customers' recent order products and obtain signed download links, potentially leading to unauthorized access to paid digital files and exposure of sensitive order information. Defenders should assess exposure, verify patching, and restrict access to sensitive data to prevent potential misuse.

• Potential unauthorized access to paid digital files
• Exposure of sensitive order information
• Possible misuse of signed download links
• Verification of patching and access controls required

Technical summary

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase. This vulnerability allows unauthorized access to paid digital files and exposes sensitive order information, impacting defenders responsible for WordPress installations with Easy Digital Downloads plugin versions older than 3.7.1.

Defensive priority

Assess exposure and verify patching for Easy Digital Downloads plugin versions older than 3.7.1

Recommended defensive actions

• Verify Easy Digital Downloads plugin version and update to 3.7.1 or later if necessary
• Restrict access to sensitive order data and download links
• Monitor for suspicious activity related to digital file downloads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the full scope of affected versions and potential impact. The CVE Program and NVD records indicate that the vulnerability exists in Easy Digital Downloads plugin versions before 3.7.1. However, additional research is needed to confirm the exact scope of the vulnerability and its potential impact on affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.