CVE-2026-6798: WordPress 2Download Connector Unauthenticated Data Exposure via Missing Authorization

Vulnerability Overview Vulnerability Name: 2Download Connector for 2DL Hosted Checkout <= 0.1.5 - Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload_email' Parameter Vulnerability Description: The 2Download Connector for 2DL Hosted Checkout plugin contains an unauthorized access vulnerability, allowing unauthenticated attackers to view subscription data for any customer, including subscription status, product names, order IDs, purchase dates, and expiration dates. CVSS Score: 5.3 (Medium) CVE ID: CVE-2026-6798 Release Date: June 18, 2026 Last Updated: June 19, 2026 Researcher: Mohamed Haidar Affected Scope Software Type: Plugin Software Slug: 2download-connector Affected Versions: <= 0.1.5 Patched Version: 0.1.6 Remediation Recommendation: Upgrade to version 0.1.6 or later patched versions. Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Share Options This vulnerability information can be shared via Facebook, Twitter, LinkedIn, and Email. Disclaimer This record contains copyrighted material, copyright owned by Defiant Inc. and The MITRE Corporation. Contact For any errors or to add information, please contact wfi-support@wordfence.com. Business Hours Business hours are 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT, excluding weekends and holidays. 24-hour customer support is available 365 days a year, with a response time of 1 hour. Terms of Service Links to Terms of Service, Privacy Policy, Notices, and Do Not Sell or Share My Personal Information. Social Media Follow Wordfence on X, Facebook, YouTube, and Instagram. Products and Support Products include Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, and Wordfence Central. Support includes Documentation, Learning Center, Free Support, and Premium Support. News and About News includes Blog, In The News, and Vulnerability Advisories. About includes About Wordfence, Affiliate Program, Employment, Contact, Security, and CVE Request Form. Subscribe for Updates Subscribe to Wordfence news and updates by entering your email address and agreeing to the Terms of Service and Privacy Policy. Copyright Information Copyright © 2012-2026 Defiant Inc. All rights reserved. Other The bottom of the page features the Wordfence Intelligence logo and the Defiant logo.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-6798: WordPress 2Download Connector Unauthenticated Data Exposure via Missing Authorization

More from this source