CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII.
Explanation of Vulnerability in Simple Terms
Easy Digital Downloads versions 3.2.9 and earlier expose sensitive information through improper logging or error handling. An attacker on the network can read confidential data without authentication. The vulnerability affects all installations of the plugin up to version 3.2.9. Site administrators should update to a version newer than 3.2.9 to mitigate exposure.
What an attacker can do
Read sensitive information from the site without logging in.
Potential impact on your site
Customer data, payment details, or other confidential information may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
