CVE-2024-2302: Easy Digital Downloads Information Disclosure

CVE-2024-2302 Overview

The Easy Digital Downloads plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 3.2.9. Unauthenticated attackers can download the plugin's debug log through Directory Listing on the web server. The exposed log file may contain personally identifiable information (PII) captured during eCommerce transactions and plugin operations. The flaw is tracked under CWE-532: Insertion of Sensitive Information into Log File and impacts WordPress sites running the plugin as a payments and digital downloads store.

Critical Impact
Unauthenticated remote attackers can retrieve debug logs containing PII from vulnerable WordPress sites without any user interaction.

Affected Products

Awesomemotive Easy Digital Downloads plugin for WordPress, all versions up to and including 3.2.9
WordPress sites with the plugin's debug logging enabled
WordPress hosting environments where directory listing is not restricted at the web server level

Discovery Timeline

2024-04-09 - CVE-2024-2302 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2302

Vulnerability Analysis

Easy Digital Downloads writes operational and error information to a debug log stored within the plugin's upload directory on the WordPress host. Because the log file location is predictable and the containing directory permits directory listing, unauthenticated HTTP requests can enumerate and download the log. The log may include order data, customer email addresses, gateway responses, and other PII generated during checkout or plugin activity. The issue is a classic information disclosure pattern where sensitive runtime data is stored inside the web root without access controls.

Root Cause

The root cause is inadequate protection of a server-side log file that is placed inside a publicly reachable directory. Neither .htaccess restrictions nor randomization of the log path were enforced in vulnerable releases, and the debug logging routine in class-edd-logging.php did not prevent web retrieval. When directory listing is enabled at the web server, the file becomes trivially discoverable. This maps to CWE-532, inserting sensitive information into log files that are subsequently exposed.

Attack Vector

An attacker sends an unauthenticated HTTP GET request to the plugin's upload directory, browses the directory index, and downloads the debug log directly. No credentials, session, or user interaction are required. The vulnerability is remotely exploitable over the network against any affected WordPress site where directory listing is not blocked. See the Wordfence Vulnerability Report and the WordPress EDD Logging Code for technical context. No public proof-of-concept exploit is currently listed, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-2302

Indicators of Compromise

Unauthenticated HTTP GET requests targeting the Easy Digital Downloads uploads directory, particularly requests ending in .log or requesting a directory index.
Web server access log entries showing successful 200 responses for debug log filenames from external IP addresses.
Sudden bursts of requests probing common WordPress plugin upload paths from a single source.

Detection Strategies

Review web server access logs for direct requests to the Easy Digital Downloads uploads path and any .log files served with a 200 response code.
Deploy web application firewall rules that block unauthenticated retrieval of .log files under wp-content/uploads/.
Enumerate the WordPress installation to identify installed plugin versions and flag Easy Digital Downloads builds at or below 3.2.9.

Monitoring Recommendations

Alert on any HTTP response serving a file with a .log extension from the WordPress uploads directory.
Monitor for directory index responses returned by the web server, which indicate Options +Indexes is enabled.
Correlate log-file access with subsequent credential stuffing or targeted phishing against exposed customer email addresses.

How to Mitigate CVE-2024-2302

Immediate Actions Required

Update Easy Digital Downloads to a version later than 3.2.9, which contains the fix applied in the WordPress EDD Changeset Update.
Disable directory listing at the web server level for the WordPress wp-content/uploads/ tree.
Rotate any secrets, API keys, or customer notifications that may have been exposed if the debug log was previously retrievable.

Patch Information

Awesomemotive addressed the issue in the Easy Digital Downloads plugin update that followed changeset 3060808 in the plugin's trunk. The fix hardens debug log handling in includes/class-edd-logging.php so that log data is no longer trivially downloadable from the uploads directory. Site administrators should upgrade to the latest available release from the WordPress plugin repository.

Workarounds

Add a web server rule to deny direct HTTP access to .log files inside wp-content/uploads/edd/ and similar plugin paths.
Disable debug logging in the Easy Digital Downloads settings until the plugin is upgraded.
Manually delete existing debug log files from the uploads directory and audit their prior contents for PII exposure.

bash

# Apache: block direct access to .log files in the uploads tree
<FilesMatch "\.log$">
    Require all denied
</FilesMatch>

# Apache: disable directory listing globally in wp-content/uploads
Options -Indexes

# Nginx: deny .log files and directory autoindex under uploads
location ~* /wp-content/uploads/.*\.log$ {
    deny all;
    return 403;
}
autoindex off;