# Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via 'payment-id' Parameter

- **ID:** WPSEC-2026-1067
- **Plugin:** Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (`easy-digital-downloads`), https://wordpress.org/plugins/easy-digital-downloads/
- **Affected versions:** all versions before 3.7.2
- **Fixed in:** 3.7.2 (Update to 3.7.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/easy-digital-downloads
- **Fix released:** 2026-10-14
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1067/

## Description

The Easy Digital Downloads plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'payment-id' parameter of the failed transaction page in all versions up to, and including, 3.7.1.1, due to the edd_listen_for_failed_payments() function taking the order ID from that parameter without checking that the order belongs to the visitor's checkout session. This makes it possible for unauthenticated attackers to mark other customers' pending orders as failed, which also gives back the discount uses those orders held.

## References

- https://wpsec.com/vuln/WPSEC-2026-1067/
- https://plugins.svn.wordpress.org/easy-digital-downloads/tags/3.7.2/
- https://wordpress.org/plugins/easy-digital-downloads/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1067/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.