CVE-2026-12476: Easy Digital Downloads RCE Vulnerability

CVE-2026-12476 Overview

The Easy Digital Downloads plugin for WordPress contains an arbitrary file upload vulnerability affecting versions up to and including 3.6.9. The flaw resides in the edd_do_ajax_import_file_upload() function, which performs insufficient file type validation during CSV import operations. Authenticated attackers with Shop Manager-level access or higher can upload arbitrary files to the affected site's server. Successful exploitation may lead to remote code execution on the underlying host. The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated attackers with Shop Manager privileges can upload PHP or other executable files to wp-content/uploads/edd/exports/, enabling remote code execution on the WordPress host.

Affected Products

Easy Digital Downloads WordPress plugin versions up to and including 3.6.9
Easy Digital Downloads 3.6.7 (confirmed vulnerable via source references)
Easy Digital Downloads 3.6.8 (confirmed vulnerable via source references)

Discovery Timeline

2026-07-29 - CVE-2026-12476 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-12476

Vulnerability Analysis

The vulnerability exists in the CSV import handler exposed through the plugin's admin AJAX endpoint. The edd_do_ajax_import_file_upload() function is responsible for accepting import files submitted by administrators or Shop Managers. Instead of validating the actual file contents or extension against an allow-list, the function inspects only the client-supplied $_FILES['edd-import-file']['type'] Content-Type header. Since this header is fully controlled by the HTTP client, an attacker can trivially set it to text/csv or application/vnd.ms-excel while uploading a PHP payload.

After the header check passes, the function calls move_uploaded_file() directly. This bypasses WordPress core's wp_handle_upload() routine, which normally enforces server-side MIME sniffing and extension filtering through wp_check_filetype_and_ext(). The file is written to wp-content/uploads/edd/exports/ under its original filename and extension, placing it within the web-accessible document root.

Root Cause

The root cause is reliance on attacker-controlled metadata for security decisions. The plugin trusts the Content-Type header supplied in the multipart form submission and performs no verification of the file extension, magic bytes, or actual content. Bypassing wp_handle_upload() removes the last defensive layer that would have blocked executable extensions.

Attack Vector

Exploitation requires authenticated access at the Shop Manager role or higher. An attacker with valid credentials submits an AJAX POST request to the EDD import endpoint containing a file named with a .php (or similar executable) extension while spoofing the Content-Type field to a CSV mime type. The plugin accepts the upload and writes it to wp-content/uploads/edd/exports/. The attacker then issues an HTTP request to the uploaded file's URL, triggering PHP execution under the web server's context. See the Wordfence Vulnerability Analysis and the WordPress EDD Import Function Code for technical details.

Detection Methods for CVE-2026-12476

Indicators of Compromise

Presence of files with executable extensions such as .php, .phtml, or .phar under wp-content/uploads/edd/exports/.
Web server access log entries showing direct GET or POST requests to files inside wp-content/uploads/edd/exports/.
Unexpected outbound network connections originating from the PHP-FPM or web server process following an import operation.
New or modified WordPress administrator accounts created shortly after an import upload event.

Detection Strategies

Monitor HTTP requests to admin-ajax.php with the EDD import action and inspect the associated multipart uploads for non-CSV extensions.
Deploy file integrity monitoring on the wp-content/uploads/edd/exports/ directory to flag any file whose extension is not .csv.
Correlate authenticated Shop Manager sessions with uploads, then subsequent direct requests to the exports directory as a high-confidence exploitation signal.

Monitoring Recommendations

Enable WordPress audit logging to capture role assignments, plugin activity, and import events.
Alert on web shell indicators such as PHP files containing eval(, base64_decode(, system(, or assert( in upload directories.
Review access logs for anomalous user agents or geographies accessing the EDD administrative endpoints.

How to Mitigate CVE-2026-12476

Immediate Actions Required

Update the Easy Digital Downloads plugin to a version later than 3.6.9 that includes the fix referenced in the WordPress EDD Changeset Update.
Audit all accounts with Shop Manager or higher roles and revoke any that are not strictly required.
Inspect wp-content/uploads/edd/exports/ for any non-CSV files and remove artifacts that cannot be attributed to legitimate imports.
Rotate WordPress administrator and Shop Manager credentials if evidence of unauthorized upload activity is found.

Patch Information

The fix is applied in the plugin trunk via the referenced changeset, which modifies includes/admin/import/import-functions.php to enforce server-side file validation. Administrators should upgrade Easy Digital Downloads to the patched release available through the WordPress plugin repository. Verify the installed version through the WordPress admin console after applying updates.

Workarounds

Temporarily deactivate the Easy Digital Downloads plugin until the patched version is installed.
Restrict access to wp-admin and admin-ajax.php by source IP or through an authenticating reverse proxy.
Configure the web server to deny PHP execution within wp-content/uploads/ using an .htaccess rule or nginx location directive.

bash

# Apache: block PHP execution in the EDD exports directory
# Place in wp-content/uploads/edd/exports/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
    Require all denied
</FilesMatch>

# Nginx: add to the server block
location ~* /wp-content/uploads/edd/exports/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}