CVE-2026-105194: Easy Digital Downloads Info Disclosure

CVE-2026-105194 Overview

CVE-2026-105194 affects the Easy Digital Downloads WordPress plugin in versions prior to 3.7.1. The plugin fails to restrict a block's order data to the current user. Authenticated users with subscriber-level access can view other customers' recent order products. They can also obtain signed download links that grant access to paid digital files without purchase.

The flaw is classified as information exposure [CWE-200]. It requires only low-privilege authenticated access and no user interaction to exploit.

Critical Impact
Subscriber-level accounts can enumerate other customers' orders and download paid digital products without payment, resulting in revenue loss and customer data exposure.

Affected Products

Easy Digital Downloads WordPress plugin versions before 3.7.1
WordPress sites selling digital products through Easy Digital Downloads blocks
E-commerce stores exposing EDD order blocks to authenticated subscribers

Discovery Timeline

2026-10-08 - CVE-2026-105194 published to the National Vulnerability Database
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-105194

Vulnerability Analysis

Easy Digital Downloads (EDD) provides WordPress blocks that render purchase history and recent order data. One of these blocks queries order information intended for the currently authenticated customer. The affected block does not scope the query to the requesting user's identifier.

An attacker authenticates with any subscriber-level account on the vulnerable site. They then request the block's data endpoint and receive order records belonging to unrelated customers. The returned payload includes signed download URLs that EDD normally issues only to legitimate purchasers.

The signed URLs bypass purchase verification because they are the same tokens EDD generates for paying customers. An attacker can retrieve paid digital files without completing a transaction. The flaw also leaks product purchase history, which exposes customer buying behavior.

Root Cause

The root cause is a missing authorization check in the block's data retrieval logic. The plugin returns order data based on the block's query parameters rather than filtering by the authenticated user's customer ID. This results in a broken access control condition classified as information exposure [CWE-200].

Attack Vector

Exploitation requires network access to the WordPress site and a valid subscriber account. Subscriber registration is open by default on many WordPress sites selling digital goods. After authentication, the attacker queries the vulnerable block endpoint and parses the returned order data to extract signed download links.

See the WPScan Vulnerability Report for additional technical details on the affected block.

Detection Methods for CVE-2026-105194

Indicators of Compromise

Subscriber accounts issuing repeated requests to EDD block REST endpoints or admin-ajax handlers that return order data
Unusual volumes of signed download URL redemptions from IP addresses not matching the original purchaser
Newly registered subscriber accounts followed shortly by access to order data endpoints
Download file access logs showing retrievals by users with no corresponding purchase record

Detection Strategies

Correlate authenticated REST API requests from subscriber-role users against the user_id associated with returned order records
Alert on download token redemptions where the requesting account has no matching completed order in the EDD database
Baseline normal subscriber request patterns and flag deviations toward order and download endpoints

Monitoring Recommendations

Enable WordPress REST API request logging and forward logs to a centralized SIEM for review
Monitor the wp_edd_orders and related tables for signed URL generation events tied to non-purchasing users
Review web server access logs for repeated calls to block render endpoints referencing EDD order components

How to Mitigate CVE-2026-105194

Immediate Actions Required

Upgrade the Easy Digital Downloads plugin to version 3.7.1 or later on all WordPress installations
Audit existing subscriber accounts and remove accounts that cannot be attributed to legitimate customers
Rotate or invalidate active signed download URLs where supported by the plugin configuration
Review download logs for unauthorized file retrievals and notify affected customers if exposure is confirmed

Patch Information

The vendor fixed this issue in Easy Digital Downloads 3.7.1. The patched release restricts block order data queries to the authenticated user's customer record. Site operators should install the update through the WordPress plugin manager or deploy it via their standard change control process. Reference the WPScan Vulnerability Report for release details.

Workarounds

Disable open user registration on WordPress sites that do not require it, reducing the pool of accounts that can trigger the flaw
Remove or restrict pages containing vulnerable EDD order blocks until the patch is applied
Apply a web application firewall rule blocking subscriber-role requests to EDD block data endpoints
Enforce multi-factor authentication for all non-administrative accounts to limit automated account abuse

bash

# Update Easy Digital Downloads using WP-CLI
wp plugin update easy-digital-downloads --version=3.7.1

# Verify installed version
wp plugin get easy-digital-downloads --field=version

# Optional: disable open registration until patched
wp option update users_can_register 0