CVE-2026-94590

Deferred Deferred - Pending Action

Improper Verification in Sell Downloads Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description

Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94590

EUVD

EUVD-2026-96397

Affected Vendors & Products

Vendor	Product	Version / Range
CodePeople2	Sell	Downloads 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-940	The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Verification of Source of a Communication Channel issue in the CodePeople2 Sell Downloads plugin. It allows attackers to exploit trusted credentials due to insufficient validation of communication sources. The flaw exists in versions up to 1.2.3.

Detection Guidance

To detect this vulnerability, check the version of the Sell Downloads plugin installed on your WordPress site. If the version is 1.2.3 or below, the system is vulnerable. You can verify the plugin version via the WordPress admin dashboard under Plugins or by inspecting the plugin files directly.

Impact Analysis

An attacker could impersonate a trusted source to gain unauthorized access or manipulate transactions. This may lead to data leaks, financial loss, or unauthorized changes in the Sell Downloads plugin.

Compliance Impact

This vulnerability allows unauthenticated users to access restricted pages or perform unauthorized actions, potentially viewing sensitive data of other users. This could lead to unauthorized access to personal or health-related data, which may violate GDPR and HIPAA compliance requirements for data protection and access controls.

Mitigation Strategies

Update Sell Downloads to the latest version (1.2.3 or later) to address the improper verification issue. Disable or restrict access to the affected plugin if an update is not immediately available.

Hi! I’m here to help you understand CVE-2026-94590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70