CVE-2024-43162: Easy Digital Downloads Auth Bypass Flaw

CVE-2024-43162 Overview

CVE-2024-43162 is a missing authorization vulnerability in the Easy Digital Downloads plugin for WordPress, developed by Awesome Motive. The flaw affects all versions of the plugin up to and including 3.2.12. An authenticated attacker with low privileges can abuse incorrectly configured access control checks to perform actions restricted to higher-privileged roles. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
An authenticated low-privileged user can bypass access control checks in Easy Digital Downloads, leading to unauthorized modifications and full impact on confidentiality, integrity, and availability of the affected WordPress site.

Affected Products

Easy Digital Downloads for WordPress, all versions up to and including 3.2.12
WordPress sites running the Awesome Motive Easy Digital Downloads plugin as an e-commerce backend
Downstream sites using Easy Digital Downloads extensions that rely on the plugin's access control functions

Discovery Timeline

2024-11-01 - CVE-2024-43162 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43162

Vulnerability Analysis

Easy Digital Downloads exposes administrative and store-management functionality through WordPress AJAX and REST endpoints. The plugin fails to enforce proper capability checks on one or more of these endpoints. As a result, a user with a low-privileged authenticated session can invoke functionality intended for shop managers or administrators.

Because the flaw sits inside an e-commerce plugin, exploitation can affect orders, downloads, discounts, and customer data. The attacker does not need to bypass authentication, only to hold any valid low-privileged account such as subscriber or customer.

Root Cause

The root cause is a broken access control pattern classified as CWE-862. Affected handlers either omit a current_user_can() capability check or rely solely on nonce verification, which confirms request intent but not user authorization. Nonces are also accessible to any authenticated session that can render plugin pages, so intent checks alone do not restrict privilege.

Attack Vector

Exploitation requires network access to the target WordPress site and a valid low-privileged account. Many stores using Easy Digital Downloads permit self-registration for customers, which lowers the barrier to obtaining such an account. The attacker sends a crafted HTTP request to the vulnerable plugin endpoint and receives the effect of a privileged action without additional authentication.

No public proof-of-concept or exploit code has been published for CVE-2024-43162. Technical details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-43162

Indicators of Compromise

Unexpected POST requests from low-privileged user sessions to /wp-admin/admin-ajax.php with action parameters referencing Easy Digital Downloads handlers.
REST API traffic to /wp-json/edd-api/ or plugin-specific routes originating from customer or subscriber accounts.
Unauthorized changes to downloads, discount codes, payment records, or customer profiles that cannot be attributed to a shop manager or administrator.
New WordPress user accounts created shortly before suspicious plugin activity.

Detection Strategies

Correlate WordPress access logs with the user role of the session cookie to identify low-privileged users invoking store-management actions.
Alert on Easy Digital Downloads AJAX actions executed by users whose capabilities do not include manage_shop_settings or edit_shop_payments.
Baseline normal EDD administrative activity and flag deviations in request volume, endpoint diversity, or source IP.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform and enrich each request with the authenticated user role.
Monitor the plugin version reported by wp-content/plugins/easy-digital-downloads/easy-digital-downloads.php across all managed WordPress instances.
Track outbound calls from the WordPress host, since successful abuse often precedes data exfiltration or additional plugin installation.

How to Mitigate CVE-2024-43162

Immediate Actions Required

Upgrade Easy Digital Downloads to a version later than 3.2.12 on every WordPress site where the plugin is installed.
Audit existing WordPress user accounts and remove or disable low-privileged accounts that are not required.
Review recent order, download, and discount activity for unauthorized changes made since the vulnerable version was installed.

Patch Information

Awesome Motive addresses the missing authorization flaw in Easy Digital Downloads releases after 3.2.12. Confirm the fixed version and upgrade notes in the Patchstack Vulnerability Report before deploying. Test the upgrade in a staging environment to validate compatibility with active EDD extensions and themes.

Workarounds

Disable customer self-registration in WordPress until the plugin is upgraded to reduce the pool of accounts able to trigger the flaw.
Restrict access to /wp-admin/admin-ajax.php and Easy Digital Downloads REST routes at the web application firewall for non-administrative source ranges.
Temporarily deactivate the Easy Digital Downloads plugin on sites that cannot be patched immediately and rely on cached product pages.

bash

# Configuration example: verify installed plugin version with WP-CLI
wp plugin get easy-digital-downloads --field=version
wp plugin update easy-digital-downloads