Skip to content
Threat Feed
Subscribe

Product

Easy Digital Downloads Plugin (<= 3.6.9)

1 brief RSS
high advisory

Easy Digital Downloads Plugin Arbitrary File Upload Leads to RCE (CVE-2026-12476)

The Easy Digital Downloads plugin for WordPress versions up to and including 3.6.9 is vulnerable to Arbitrary File Upload (CVE-2026-12476) due to insufficient file type validation, allowing authenticated attackers with Shop Manager-level access or higher to upload arbitrary files which can lead to remote code execution.

Easy Digital Downloads plugin web arbitrary-file-upload rce wordpress plugin
1r 3t 1c