Unauthorized Access Vulnerability in 2Download Connector for 2DL Hosted Checkout Plugin by WordPress

CVE-2026-6798

What is CVE-2026-6798?

The 2Download Connector for 2DL Hosted Checkout plugin is susceptible to unauthorized access, permitting unauthenticated attackers to gain visibility into sensitive customer subscription information. This flaw arises from inadequate authorization verification, allowing attackers to retrieve arbitrary subscription data such as subscription statuses, product names, order IDs, purchase dates, and expiry dates. It is crucial for administrators to update to a patched version to mitigate this risk.

References