# Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Race Condition to Discount Usage Limit Bypass via Checkout

- **ID:** WPSEC-2026-1069
- **Plugin:** Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (`easy-digital-downloads`), https://wordpress.org/plugins/easy-digital-downloads/
- **Affected versions:** all versions before 3.7.2
- **Fixed in:** 3.7.2 (Update to 3.7.2 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-362
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/easy-digital-downloads
- **Fix released:** 2026-10-14
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1069/

## Description

The Easy Digital Downloads plugin for WordPress is vulnerable to a race condition via the checkout process in all versions up to, and including, 3.7.1.1, due to discount codes being checked when checkout is submitted but their uses counted only once an order completes, with no use reserved for pending orders and no atomic status check when a PayPal order is captured. This makes it possible for unauthenticated attackers to run several checkouts at the same time and redeem a discount code more times than its maximum-use or single-use limit allows.

## References

- https://wpsec.com/vuln/WPSEC-2026-1069/
- https://plugins.svn.wordpress.org/easy-digital-downloads/tags/3.7.2/
- https://wordpress.org/plugins/easy-digital-downloads/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1069/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.