CVE-2024-2302

MEDIUM

Easy Digital Downloads < 3.2.10 - Unauthenticated Sensitive Information Exposure via Debug Log Directory Listing

Title source: llm

Description

The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII.

References (3)

Core 3

Core References

Product

https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/includes/class-edd-logging.php#L621

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060808%40easy-digital-downloads%2Ftrunk&old=3042139%40easy-digital-downloads%2Ftrunk&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/0837ba20-4b47-4cc8-9eb3-322289513d79?source=cve

Scores

CVSS v3 5.3

EPSS 0.0060

EPSS Percentile 44.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-532

Status published

Products (2)

awesomemotive/easy_digital_downloads < 3.2.10

smub/Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.2.9

Published Apr 09, 2024

Tracked Since Feb 18, 2026