Executive brief
Easy Digital Downloads is a popular WordPress plugin used for selling digital products online. A security vulnerability in versions 3.6.9 and earlier allows a user with administrative privileges to delete arbitrary files from the web server. While this requires high-level access, an exploit could lead to a complete site outage or the removal of critical system data if a malicious or compromised administrator account is used.
Technical details
Easy Digital Downloads (<= 3.6.9) is vulnerable to arbitrary file deletion due to improper limitation of a pathname to a restricted directory (CWE-22, Path Traversal). The vulnerability allows an authenticated attacker with Administrator-level privileges to delete arbitrary files on the server via network requests. While the impact is limited to availability (denial of service by deleting core files), the root cause is a lack of validation on file paths handled by the plugin. As of the advisory date, no official patch has been confirmed, though users are advised to monitor for updates.
Affected products
- Syed Balkhi Easy Digital Downloads <= 3.6.9
Timeline
- 2026-06-30: other: Reported by researcher Ananda Dhakal
- 2026-07-27: disclosed: Vulnerability published by Patchstack and NVD