# CVE-2026-59524: Easy Digital Downloads broken authentication bypass

Source: https://junglewise.ai/threats/cve-2026-59524-easy-digital-downloads-broken-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-59524 · Severity: medium · CVSS 6.5 · Published 2026-07-23

Easy Digital Downloads, a popular WordPress plugin for managing digital sales, contains a security flaw that could allow unauthorized individuals to bypass authentication. This vulnerability could potentially allow an attacker to perform actions usually reserved for high-privileged users, which may lead to unauthorized access to the website's administrative functions. Business operations could be impacted by unauthorized changes to the store or potential data exposure.

## Quick answers

**Is CVE-2026-59524 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59524 being exploited in the wild.

**How severe is CVE-2026-59524?** Medium severity, with a CVSS score of 6.5, published 23 July 2026.

**Which products and versions are affected?** Sandhills Development, LLC Easy Digital Downloads <= 3.6.7.

**Is there a fix for CVE-2026-59524?** A patch was published on 2026-07-22: Version 3.6.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59524 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59524?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Easy Digital Downloads (<= 3.6.7) is vulnerable to an authentication bypass using an alternate path or channel (CWE-288). The vulnerability allows an unauthenticated remote attacker to bypass security checks and perform actions that should be restricted to higher-privileged users. According to the advisory, this could lead to gaining administrative access to the WordPress site. The issue is resolved in version 3.6.8. The CVSS vector indicates a network-based attack with low complexity and no user interaction required, though the impact is primarily on integrity and availability.

## Affected products

- Sandhills Development, LLC Easy Digital Downloads <= 3.6.7

## Timeline

- 2026-04-30: other: Reported by James Paremain
- 2026-07-22: patched: Version 3.6.8 released
- 2026-07-23: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-6-7-broken-authentication-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-6-7-broken-authentication-vulnerability?_s_id=cve)