CVE-2026-12476

The Easy Digital Downloads plugin for WordPress, in versions up to 3.6.9, has a vulnerability that allows authenticated attackers with sufficient access to upload files of any type to the server. This is because the plugin doesn't properly check the types of files being uploaded, allowing malicious files to be written to a directory that can be accessed from the web. As a result, attackers may be able to execute code remotely on the affected site.

Based on public CVE data (MITRE/NVD).