CVE-2026-105190— Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled
Quick assessment
Affected
Unknown Easy Digital Downloads
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Easy Digital Downloads 插件在 3.7.1 版本之前，在创建 WordPress 账户时未检查网站的“用户注册”设置，导致即使注册功能已禁用，未认证用户仍能创建账户并获取已登录会话。所创建的账户将自动获得网站的默认用户角色。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105190
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled
Source: CVE Program / CVE List V5
Vulnerability Description
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Easy Digital Downloads | 0 ~ 3.7.1 | - |
|
II. Public POCs for CVE-2026-105190
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105190
请登录查看更多情报信息。
Other References for CVE-2026-105190 (1)
-
https://wpscan.com/vulnerability/d167e184-af71-4ff8-8a2d-a665f7539fe4/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-08 · 24 CVEs total
| CVE-2026-93509 | 6.5 MEDIUM | Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via |
| CVE-2026-103517 | 5.3 MEDIUM | Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Web |
| CVE-2026-104671 | 5.3 MEDIUM | TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX |
| CVE-2026-103309 | GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage | |
| CVE-2026-103646 | Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Pa | |
| CVE-2026-104646 | Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortc | |
| CVE-2026-104645 | Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Im | |
| CVE-2026-103692 | Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Func | |
| CVE-2026-105195 | Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure | |
| CVE-2026-105197 | LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR | |
| CVE-2026-105198 | LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR | |
| CVE-2026-105194 | Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Dow | |
| CVE-2026-105196 | LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API | |
| CVE-2026-105193 | Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification | |
| CVE-2026-86826 | BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory | |
| CVE-2026-86827 | BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php | |
| CVE-2026-86828 | BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback | |
| CVE-2026-105260 | Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF | |
| CVE-2026-94246 | Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Reques | |
| CVE-2026-94244 | Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosu |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Easy Digital Downloads
-
CVE-2026-105194
Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Infor -
CVE-2026-42638
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Ac -
CVE-2026-95522
WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injec -
CVE-2026-66476
WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary -
CVE-2026-59524
WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Au
Same vendor: Unknown
-
CVE-2026-93509
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ W -
CVE-2026-103517
Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated -
CVE-2026-104671
TutorStarter < 4.0.4 - Unauthenticated User Registration Byp -
CVE-2026-94245
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ A -
CVE-2026-94275
Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII D
V. Comments for CVE-2026-105190
No comments yet