tadrik Free store check

Plugin security / Easy Digital Downloads

Easy Digital Downloads vulnerability: is your WooCommerce store affected?

Easy Digital Downloads has 12 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 3 November 2026. Every one is fixed: update to 3.7.3 or newer.

Short answer: your store is affected if it runs Easy Digital Downloads older than 3.7.3. Update to 3.7.3 or newer, on a copy of the store first if you can.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 8.1 (high)no login neededAffected: older than 3.7.3Fixed in 3.7.3Published 3 November 2026CVE-2026-120538

    Advisory: The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2.

  2. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 3.6.9.1Fixed in 3.6.9.1Published 8 October 2026CVE-2026-14335

    Advisory: The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due...

  3. Missing permission check

    An action that should need permission could be done without it.

    Score 7.5 (high)no login neededAffected: older than 3.7.1.1Fixed in 3.7.1.1Published 23 September 2026CVE-2026-42638

    Advisory: Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads:...

  4. Missing permission check

    An action that should need permission could be done without it.

    Score 7.5 (high)no login neededAffected: older than 3.6.6Fixed in 3.6.6Published 20 April 2026CVE-2026-39503

    Advisory: Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.

  5. Missing permission check

    An action that should need permission could be done without it.

    Score 8.8 (high)needs only a customer accountAffected: older than 3.3.1Fixed in 3.3.1Published 7 August 2024CVE-2024-43162

    Advisory: Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.2.12.

  6. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.8 (critical)no login neededAffected: older than 3.3.1Fixed in 3.3.1Published 1 August 2024CVE-2024-5057

    Advisory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.

  7. Cross-site request forgery

    Someone could trick a logged-in admin into making a change.

    Score 8.8 (high)no login neededAffected: older than 3.2.12Fixed in 3.2.12Published 9 May 2024CVE-2024-31113

    Advisory: Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.

  8. Data exposure

    Information meant to stay private could be read.

    Score 7.5 (high)no login neededAffected: older than 3.2.12Fixed in 3.2.12Published 9 May 2024CVE-2024-32100

    Advisory: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.

  9. Cross-site request forgery

    Someone could trick a logged-in admin into making a change.

    Score 8.8 (high)no login neededAffected: older than 3.2.7Fixed in 3.2.7Published 5 April 2024CVE-2024-31293

    Advisory: Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6.

  10. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.8 (critical)no login neededAffected: older than 3.1.0.4Fixed in 3.1.0.4Published 12 January 2023CVE-2023-23489

    Advisory: The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.

2 older holes, published before 1 January 2023

  1. Spreadsheet formula injection

    A spreadsheet exported from the store could run a harmful formula when someone opens it.

    Score 9.8 (critical)no login neededAffected: older than 3.1.0.2Fixed in 3.1.0.2Published 28 September 2022CVE-2022-3600

    Advisory: The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.

  2. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.8 (critical)no login neededAffected: older than 2.3.3Fixed in 2.3.3Published 16 August 2019CVE-2015-9324

    Advisory: The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find Easy Digital Downloads. The version number is under its name. If it is lower than 3.7.3, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/easy-digital-downloads/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update Easy Digital Downloads to 3.7.3 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use Easy Digital Downloads.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use Easy Digital Downloads, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which Easy Digital Downloads version fixes it?
Version 3.7.3 or newer fixes all 12 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs Easy Digital Downloads older than 3.7.3. In WordPress, open Plugins and read the version under Easy Digital Downloads. Without logging in, open yourstore.com/wp-content/plugins/easy-digital-downloads/readme.txt and read the Stable tag line.
I don't use Easy Digital Downloads any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 5 November 2026.