CVE-2026-12476

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions prior to 3.7.0

Description Insufficient file type validation in the edd do ajax import file upload() function allows authenticated attackers with Shop Manager-level access or higher to upload arbitrary files to the server. The issue occurs because the system only verifies the edd-import-file parameter's Content-Type header against a CSV mime type allow-list and uses move uploaded file() to save the file in the wp-content/uploads/edd/exports/ directory, bypassing core MIME enforcement. This could lead to remote code execution.

Recommendations Update to a version newer than 3.6.9. As a temporary workaround, restrict access to the edd do ajax import file upload() function for users with Shop Manager-level access.