{
 "id": "WPSEC-2026-1069",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1069/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1069/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1069/index.md",
 "title": "Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Race Condition to Discount Usage Limit Bypass via Checkout",
 "description": "The Easy Digital Downloads plugin for WordPress is vulnerable to a race condition via the checkout process in all versions up to, and including, 3.7.1.1, due to discount codes being checked when checkout is submitted but their uses counted only once an order completes, with no use reserved for pending orders and no atomic status check when a PayPal order is captured. This makes it possible for unauthenticated attackers to run several checkouts at the same time and redeem a discount code more times than its maximum-use or single-use limit allows.",
 "plugin": {
  "slug": "easy-digital-downloads",
  "name": "Easy Digital Downloads",
  "full_name": "Easy Digital Downloads – eCommerce Payments and Subscriptions made easy",
  "wordpress_org": "https://wordpress.org/plugins/easy-digital-downloads/",
  "advisories_url": "https://wpsec.com/vuln/plugin/easy-digital-downloads/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/easy-digital-downloads"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-362"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.7.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.7.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.7.2",
 "remediation": "Update to 3.7.2 or later.",
 "fix_released": "2026-10-14T22:45:10+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T10:56:05.111647+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1069/",
  "https://plugins.svn.wordpress.org/easy-digital-downloads/tags/3.7.2/",
  "https://wordpress.org/plugins/easy-digital-downloads/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/easy-digital-downloads",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}