{"id":"CVE-2026-42638","published":"2026-10-06T09:17:55.627","lastModified":"2026-10-07T08:16:57.320","description":"Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-7-1-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows attackers to bypass authorization checks in Easy Digital Downloads, enabling them to perform actions they shouldn't be able to, such as modifying or deleting downloads without proper access rights. This represents a significant security gap where the application fails to verify user permissions correctly.","exploitability":"Exploitation is relatively straightforward with no special preconditions required, as the vulnerability affects unauthenticated users and can be triggered through standard API calls or web requests.","blast_radius":"If exploited, attackers could modify or delete digital downloads, potentially affecting thousands of products and customer orders across the affected platform.","remediation":"Upgrade to version 3.7.2 or later to address this authorization bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","access-control","web-application","e-commerce"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:06:45.385Z"}}