The Easy Digital Downloads WordPress plugin contains an unvalidated redirect flaw in the password‑reset workflow. An unauthenticated attacker can supply a malicious URL with the edd_redirect parameter, causing the password‑reset email to link to a site of the attacker’s choosing. This redirect can be used to trick users into visiting phishing pages that harvest credentials or install malware. The vulnerability does not provide direct code execution but enables social engineering attacks that compromise user confidentiality and could undermine the integrity of the site’s authentication process.

All installations of the Easy Digital Downloads plugin for WordPress up to and including version 3.6.2 are affected. The vulnerability is tied to the password‑reset functionality whereby a redirect URL is supplied via the edd_redirect parameter.

The CVSS score of 4.3 reflects a medium impact but low exploitation potential; the EPSS score of less than 1% indicates that exploitation is unlikely at this time. The flaw is not currently listed in the CISA KEV catalogue, suggesting limited known exploitation. Nevertheless an attacker could exploit this by persuading a user to click a password‑reset link that is redirected to a malicious site, making the threat realistic for any website that relies on the plugin and uses the default password‑reset flow.