CVE-2026-105190: Easy Digital Downloads Auth Bypass

CVE-2026-105190 Overview

CVE-2026-105190 affects the Easy Digital Downloads WordPress plugin in versions prior to 3.7.1. The plugin fails to consult the site's user registration setting before creating a WordPress account. Unauthenticated attackers can create accounts and receive a logged-in session even when registration is disabled. New accounts receive the site's default role, which bypasses administrator intent to restrict account creation. The weakness falls under [CWE-862] Missing Authorization.

Critical Impact

Unauthenticated users can create accounts and obtain active sessions on WordPress sites where registration has been explicitly disabled, undermining access control policies.

Affected Products

• Easy Digital Downloads WordPress plugin versions before 3.7.1
• WordPress sites using the plugin with user registration disabled
• WordPress environments where the default role grants more than minimum privileges

Discovery Timeline

• 2026-10-08 - CVE-2026-105190 published to the National Vulnerability Database (NVD)
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-105190

Vulnerability Analysis

The Easy Digital Downloads plugin exposes an account creation path that does not verify the WordPress users_can_register option. When a visitor submits the account creation request, the plugin provisions a WordPress user record and initiates a logged-in session regardless of the site's registration policy.

The resulting account inherits the site's default role, typically subscriber. Where administrators have changed the default role or installed plugins that grant elevated capabilities to the default role, the impact of unauthorized account creation increases. The flaw affects the integrity of the WordPress authentication boundary but does not directly disclose data or disrupt availability.

Root Cause

The root cause is a missing authorization check [CWE-862]. The plugin's registration logic does not call the WordPress API that reports whether open registration is allowed. The code path assumes registration is permissible and proceeds to create the user and authenticate the session.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the plugin's account creation endpoint. No user interaction and no prior credentials are required. The server responds with a valid authenticated session cookie bound to the newly created account.

Attackers can automate this process to enumerate accounts, abuse features reserved for authenticated users, or stage follow-on attacks that depend on being logged in. Refer to the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-105190

Indicators of Compromise

• Unexpected WordPress user accounts in wp_users created after the plugin was installed, especially on sites where registration is disabled
• POST requests to Easy Digital Downloads registration or checkout endpoints originating from unauthenticated clients
• Session cookies issued to clients that never completed an administrator-approved registration flow
• Spikes in new accounts holding the site's default role within short time windows

Detection Strategies

• Compare the WordPress users_can_register setting against the rate of newly created accounts; any new accounts while registration is off indicate exploitation
• Review web server access logs for anomalous POST traffic to Easy Digital Downloads endpoints from distinct IP addresses
• Alert on account creation events that lack a preceding administrator action or legitimate storefront purchase flow

Monitoring Recommendations

• Forward WordPress audit logs and web server access logs to a centralized analytics platform for correlation
• Track the installed version of Easy Digital Downloads across managed WordPress properties and flag any version below 3.7.1
• Monitor privilege assignments for newly created users to detect inherited roles that exceed subscriber

How to Mitigate CVE-2026-105190

Immediate Actions Required

• Upgrade Easy Digital Downloads to version 3.7.1 or later on every affected WordPress site
• Audit the wp_users table and remove or disable accounts that were created without administrator approval
• Rotate credentials and revoke active sessions for any suspicious accounts identified during the audit
• Confirm the WordPress default role is set to the lowest privilege required for your site

Patch Information

The maintainers resolved the issue in Easy Digital Downloads version 3.7.1. The fixed release consults the site's registration setting before provisioning a WordPress account. See the WPScan Vulnerability Report for the advisory and remediation reference.

Workarounds

• Restrict access to the Easy Digital Downloads registration and checkout endpoints at the web application firewall until the plugin is upgraded
• Temporarily disable the plugin on sites that do not require active e-commerce functionality
• Reduce privileges attached to the WordPress default role so that any unauthorized account creation yields minimal capability

# Verify the installed Easy Digital Downloads version and update via WP-CLI
wp plugin get easy-digital-downloads --field=version
wp plugin update easy-digital-downloads --version=3.7.1

# Confirm registration policy and current default role
wp option get users_can_register
wp option get default_role