Junglewise Threat Intelligence

CVE-2026-12476: Easy Digital Downloads arbitrary file upload in edd_do_ajax_import_file_upload

CVE-2026-12476 · Severity: high · CVSS 7.2 · Published 2026-07-29

Technologies: Sandhills Development (smub) Easy Digital Downloads.

Executive brief

Easy Digital Downloads, a popular WordPress plugin for managing online sales, contains a security flaw in its file import feature. An attacker with administrative or shop manager privileges can bypass security checks to upload malicious files, such as web shells, to the server. This could allow the attacker to take full control of the website, access sensitive customer data, or disrupt business operations.

Technical details

The vulnerability exists in the edd_do_ajax_import_file_upload() function, which performs insufficient validation by only checking the client-supplied 'Content-Type' header against an allow-list of CSV mime types. Because the function uses raw move_uploaded_file() instead of WordPress's core wp_handle_upload() function, it bypasses standard MIME enforcement and writes files with their original extensions into the web-accessible /wp-content/uploads/edd/exports/ directory. Authenticated attackers with Shop Manager-level permissions or higher can exploit this to upload PHP files, leading to remote code execution (RCE). The issue is addressed in versions following 3.6.9.

Affected products

  • Sandhills Development (smub) Easy Digital Downloads <= 3.6.9

Timeline

  • 2026-07-29: disclosed
  • 2026-07-29: advisory

References