Sensitive Information Exposure in Easy Digital Downloads Plugin for WordPress
CVE-2025-2252
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 March 2025
What is CVE-2025-2252?
The Easy Digital Downloads plugin for WordPress is susceptible to a vulnerability that enables unauthorized users to access sensitive information. Specifically, through the edd_ajax_get_download_title() function, attackers can extract private post titles of downloads in all versions up to and including 3.3.6.1. This flaw can lead to unintentional information disclosure, potentially exposing details that users would not normally have access to. Website owners using vulnerable versions of the plugin should take immediate action to secure their sites.
Affected Version(s)
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy * <= 3.3.6.1