CVE-2025-2252 Overview
CVE-2025-2252 is an information disclosure vulnerability in the Easy Digital Downloads plugin for WordPress. The flaw affects all versions up to and including 3.3.6.1 and exists in the edd_ajax_get_download_title() function. Unauthenticated attackers can send crafted AJAX requests to retrieve titles of private download posts that should not be publicly accessible. The issue is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). The vendor addressed the flaw in changeset 3257409 published to the WordPress plugin repository.
Critical Impact
Unauthenticated remote attackers can enumerate private download post titles through the plugin's AJAX endpoint, exposing information intended to remain confidential.
Affected Products
- Awesomemotive Easy Digital Downloads for WordPress
- All versions up to and including 3.3.6.1
- Sites using the edd_ajax_get_download_title() AJAX function
Discovery Timeline
- 2025-03-25 - CVE-2025-2252 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2252
Vulnerability Analysis
The vulnerability resides in the edd_ajax_get_download_title() function located in includes/ajax-functions.php of the Easy Digital Downloads plugin. This AJAX handler is registered for both authenticated and unauthenticated users through WordPress wp_ajax_nopriv_ hooks. When invoked, the function retrieves and returns the title of a download post identified by an attacker-supplied post ID.
The function fails to verify whether the requested download post is publicly accessible. As a result, it returns titles for posts in private, draft, or pending status. An unauthenticated attacker can iterate through post IDs and collect titles of downloads that site administrators intended to keep hidden.
The impact is bounded because only post titles are returned, not post content, pricing configuration, or customer data. Sites that rely on private downloads for staged product releases or internal use lose confidentiality of those product names.
Root Cause
The root cause is a missing authorization and post-status check in the AJAX handler. The function does not call get_post_status() to validate that the target download is publish before returning its title. This constitutes a Broken Access Control condition on a read operation.
Attack Vector
Exploitation requires only network access to the target WordPress site. An attacker sends HTTP POST requests to /wp-admin/admin-ajax.php with the action parameter set to the vulnerable handler and a download_id value. The server responds with the post title regardless of the post's visibility status. No authentication, user interaction, or elevated privileges are required. The exploit primitive is limited to enumeration of download titles.
See the WordPress Plugin Code Reference for the vulnerable code path and the Wordfence Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-2252
Indicators of Compromise
- Unauthenticated POST requests to /wp-admin/admin-ajax.php with action=edd_ajax_get_download_title and varying download_id values.
- Sequential enumeration patterns across download post IDs from a single source IP or small IP range.
- Elevated volumes of admin-ajax.php traffic without associated session cookies or authenticated referers.
Detection Strategies
- Inspect web server access logs for repeated admin-ajax.php requests referencing the edd_ajax_get_download_title action.
- Configure a Web Application Firewall (WAF) rule to alert on unauthenticated invocations of this specific AJAX action.
- Correlate anomalous AJAX request bursts with source reputation feeds to identify scanning activity.
Monitoring Recommendations
- Enable verbose logging on the WordPress installation and forward admin-ajax.php events to a centralized SIEM or data lake for analysis.
- Baseline normal AJAX request rates for the Easy Digital Downloads endpoint and alert on statistical deviations.
- Track the installed plugin version across WordPress fleets to prioritize hosts still running 3.3.6.1 or earlier.
How to Mitigate CVE-2025-2252
Immediate Actions Required
- Update the Easy Digital Downloads plugin to the version released after changeset 3257409, which is above 3.3.6.1.
- Audit private, draft, and pending download posts to determine whether any sensitive product names were exposed.
- Restrict access to /wp-admin/admin-ajax.php at the network edge where feasible, particularly for unauthenticated actions.
Patch Information
The vendor fixed the vulnerability in the Easy Digital Downloads plugin via WordPress Plugin Changeset 3257409. The patch adds a post-status check to edd_ajax_get_download_title() so that only titles of published downloads are returned. Site owners should upgrade to the fixed release through the WordPress plugin updater or by deploying the updated package manually. A diff against the previous version is available in the Previous Changeset.
Workarounds
- Deploy a WAF rule that blocks unauthenticated POST requests carrying action=edd_ajax_get_download_title until patching is complete.
- Temporarily disable the Easy Digital Downloads plugin on sites where private downloads must remain hidden and the update cannot be applied immediately.
- Rename or remove sensitive information from private download post titles so that any residual disclosure carries no business value.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
