Vulnerabilities / Easy Digital Downloads / WPSEC-2026-1067
Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via 'payment-id' Parameter
Medium 5.3
CWE-639Fixed in 3.7.2
- ID
- WPSEC-2026-1067
- Plugin
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (easy-digital-downloads)
- Affected
- all versions before 3.7.2
- Remediation
- Update to 3.7.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Easy Digital Downloads on WPSec AttackSurface
- Fix released
- Published
Description
The Easy Digital Downloads plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'payment-id' parameter of the failed transaction page in all versions up to, and including, 3.7.1.1, due to the edd_listen_for_failed_payments() function taking the order ID from that parameter without checking that the order belongs to the visitor's checkout session. This makes it possible for unauthenticated attackers to mark other customers' pending orders as failed, which also gives back the discount uses those orders held.
References
- https://wpsec.com/vuln/WPSEC-2026-1067/
- https://plugins.svn.wordpress.org/easy-digital-downloads/tags/3.7.2/
- https://wordpress.org/plugins/easy-digital-downloads/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS