CVE-2026-12476: Easy Digital Downloads arbitrary file upload in edd_do_ajax_import_file_upload

CVE-2026-12476 · Severity: high · CVSS 7.2 · Published 2026-07-29

Easy Digital Downloads, a popular WordPress plugin for managing online sales, contains a security flaw in its file import feature. An attacker with administrative or shop manager privileges can bypass security checks to upload malicious files, such as web shells, to the server. This could allow the attacker to take full control of the website, access sensitive customer data, or disrupt business operations.

Quick answers

Is CVE-2026-12476 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12476 being exploited in the wild.
How severe is CVE-2026-12476?
High severity, with a CVSS score of 7.2, published 29 July 2026.
Which products and versions are affected?
Sandhills Development (smub) Easy Digital Downloads <= 3.6.9.
Is there a fix for CVE-2026-12476?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12476 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12476?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the edd_do_ajax_import_file_upload() function, which performs insufficient validation by only checking the client-supplied 'Content-Type' header against an allow-list of CSV mime types. Because the function uses raw move_uploaded_file() instead of WordPress's core wp_handle_upload() function, it bypasses standard MIME enforcement and writes files with their original extensions into the web-accessible /wp-content/uploads/edd/exports/ directory. Authenticated attackers with Shop Manager-level permissions or higher can exploit this to upload PHP files, leading to remote code execution (RCE). The issue is addressed in versions following 3.6.9.

Affected products

  • Sandhills Development (smub) Easy Digital Downloads <= 3.6.9

Timeline

  • 2026-07-29: disclosed
  • 2026-07-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.