CVE-2026-12476 HIGH

CVE-2026-12476: Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter

Vendor Smub
Product Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Weakness CWE-434 · Unrestricted file upload
Published July 29, 2026
Last update July 29, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Explanation of Vulnerability in Simple Terms

02Summary

Easy Digital Downloads versions 3.6.9 and earlier allow authenticated administrators to upload files without proper type validation. An attacker with admin access can upload executable files, potentially running malicious code on the site. This affects confidentiality, integrity, and availability of the installation.

What an attacker can do

03Attacker Capabilities

Upload and execute malicious files on the site with admin privileges.

Potential impact on your site

04Site Impact

A compromised admin account can upload malware, modify site files, or steal data.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

July 29, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-56290 Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 CVE-2024-58349 WordPress Theme Travelscape 1.0.3 Arbitrary File Upload CVE-2026-9227 GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter CVE-2026-2354 Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files() CVE-2026-6555 ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'