PT-2025-12768 · WordPress · Easy Digital Downloads

Françoa Taffarel · Published 2025-03-25 · Updated 2025-08-08 · CVE-2025-2252

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads – eCommerce Payments and Subscriptions plugin for WordPress versions up to, and including, 3.3.6.1

Description The issue allows unauthenticated attackers to extract private post titles of downloads via the edd ajax get download title() function. The impact of this issue is minimal.

Recommendations For versions up to, and including, 3.3.6.1, consider updating to a version that contains a fix for this issue, as no specific mitigation measures are provided for these versions. As a temporary workaround, consider disabling the edd ajax get download title() function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-2252

Affected Products

Easy Digital Downloads

References · 12

• https://plugins.trac.wordpress.org/changeset/3257409/easy-digital-downloads/trunk/includes/ajax-functions.php?old=3226442&old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fajax-functions.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-2252 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2252 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3257409/easy-digital-downloads/trunk/includes/ajax-functions.php?contextall=1 · Patch
• https://twitter.com/CVEnew/status/1904436201148617184 · Twitter Post
• https://t.me/cvedetector/21053 · Telegram Post
• https://t.me/cveNotify/131496 · Telegram Post
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.3.6.1/includes/ajax-functions.php#L459 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9e0e3b81-55fe-46b2-bae1-d7321d74c485?source=cve · Note
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.3.6.1/includes/ajax-functions.php#L466 · Note
• https://t.me/cvenotify/116027 · Telegram Post
• https://t.me/cvetracker/19852 · Telegram Post