Easy Digital Downloads <= 3.6.9 Authenticated Arbitrary File Upload via 'edd-import-file' Parameter (CVE-2026-12476)

Vulnerability Overview Vulnerability Name: Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter CVE ID: CVE-2026-12476 CVSS Score: 7.2 (High) Release Date: July 28, 2026 Last Updated: July 29, 2026 Researcher: Tal Kantor Affected Scope Affected Software: Easy Digital Downloads Affected Versions: <= 3.6.9 Fixed Version: 3.6.9.1 Remediation Mitigation: Update to version 3.6.9.1 or later patched versions. Vulnerability Description An arbitrary file upload vulnerability exists in the Easy Digital Downloads plugin up to version 3.6.9. This vulnerability is caused by insufficient file type validation in the function, which only checks the header provided by the client in , rather than using the MIME type enforcement via from . This allows attackers to upload files to the directory, potentially leading to remote code execution. References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: easy-digital-downloads Fixed: Yes Affected Versions: <= 3.6.9 Fixed Version: 3.6.9.1 Recent Vulnerabilities Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter - CVE ID: CVE-2026-7533 - CVSS Score: 4.3 - Researcher: typeSafe - Date: May 27, 2026 Easy Digital Downloads - eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization - CVE ID: CVE-2026-39503 - CVSS Score: 5.3 - Researcher: Jakub Herman - Date: April 20, 2026 Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via 'edd_redirect' - CVE ID: CVE-2025-14783 - CVSS Score: 4.3 - Researcher: shark3y - Date: December 30, 2025 Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation - CVE ID: CVE-2025-11271 - CVSS Score: 5.3 - Researcher: Jay - Date: November 5, 2025 Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via 'edd_sendwp_disconnect' and 'edd_sendwp_remote_install' Functions - CVE ID: CVE-2025-8102 - CVSS Score: 5.4 - Researcher: wesley (wcraft) - Date: August 19, 2025 Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor) Stored Cross-Site Scripting via 'edd_receipt' Shortcode - CVE ID: CVE-2025-4670 - CVSS Score: 6.4 - Researcher: Muhammad Yutha-DJ - Date: May 28, 2025 Easy Digital Downloads - eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure - CVE ID: CVE-2025-2252 - CVSS Score: 5.3 - Researcher: François Taffarel - Date: March 24, 2025 Easy Digital Downloads - Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title - CVE ID: CVE-2024-13517 - CVSS Score: 4.4 - Researcher: Sajjad Ahmad (jack_sparrow) - Date: January 17, 2025 Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download - CVE ID: CVE-2024-12875 - CVSS Score: 4.9 - Researcher: Sajjad Ahmad (jack_sparrow) - Date: December 20, 2024 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass - CVE ID: CVE-2024-9654 - CVSS Score: 3.7 - Researcher: Arkadiusz Hydrık - Date: December 16, 2024 Additional Information Wordfence Intelligence offers free personal and commercial API access Install Wordfence for the latest vulnerability notifications Wordfence Intelligence WordPress Vulnerability Database is completely free to access and query Footer Information Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Contact Us Email: support@wordfence.com Business Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24-hour support, 365 days a year, with a 1-hour response time Copyright Copyright 2012-2026 Defiant Inc. All Rights Reserved Other Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Stay Updated: Sign up for news and updates from our panel of experienced security professionals. Social Media Links Facebook Twitter LinkedIn Email

Goal Reached Thanks to every supporter — we hit 100%!

Easy Digital Downloads <= 3.6.9 Authenticated Arbitrary File Upload via 'edd-import-file' Parameter (CVE-2026-12476)