CVE-2025-2252mediumCWE-200

CVE-2025-2252: fallo de gravedad media en smub Easy Digital Downloads – eCommerce…

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the edd_ajax_get_download_title() function. This makes it possible for unauthenticated attackers to extract private post titles of downloads. The impact here is minimal.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
smub · Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
CVEs relacionadas — smub Easy Digital Downloads – eCommerce…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-12476HIGHEasy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' ParameterEPSS 1.2%CVE-2024-12875MEDIUMEasy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File DownloadEPSS 1.0%CVE-2022-2439HIGHEasy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR DeserializationEPSS 0.7%CVE-2024-2302MEDIUMEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information ExposureEPSS 0.6%CVE-2026-120538HIGHEasy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal CaptureEPSS 0.4%CVE-2024-0659MEDIUMEasy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing optionsEPSS 0.4%