CVE-2026-12476
Received Received - Intake

Arbitrary File Upload in Easy Digital Downloads WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Wordfence

Description
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-07-29
AI Q&A
2026-07-29
EPSS Evaluated
N/A
NVD
CVE-2026-12476
EUVD
EUVD-2026-50108

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
easy_digital_downloads easy_digital_downloads to 3.6.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Easy Digital Downloads plugin for WordPress has a vulnerability in versions up to 3.6.9 that allows arbitrary file uploads. The issue is in the edd_do_ajax_import_file_upload() function, which only checks the file type against a list of CSV types but then uses a raw move_uploaded_file() function to save the file with its original extension. This bypasses WordPress's built-in MIME enforcement and allows attackers with Shop Manager access or higher to upload malicious files to the server.

Detection Guidance

Check for unauthorized files in the wp-content/uploads/edd/exports/ directory. Look for non-CSV files uploaded by users with Shop Manager-level access or higher. Review server logs for suspicious file upload activity.

Impact Analysis

This vulnerability allows authenticated attackers with Shop Manager-level access or higher to upload arbitrary files to the server. These files could include malicious scripts that enable remote code execution, potentially taking full control of the website. Attackers could steal data, deface the site, or use it to launch further attacks.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA compliance requirements. If attackers gain access to sensitive data like user information or health records, organizations could face legal penalties, fines, and reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Update the Easy Digital Downloads plugin to the latest version. Remove any unauthorized files from the uploads directory. Restrict file upload permissions to only necessary users. Monitor for signs of compromise.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12476. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart