The Easy Digital Downloads plugin for WordPress contains an authentication bypass in its AJAX handler that returns download titles. Because the edd_ajax_get_download_title() function is callable without user credentials, an attacker can retrieve the titles of private download posts. This flaw exposes confidential data that site owners may consider sensitive, and it is classified as a CWE-200 Sensitive Data Exposure vulnerability.

All installations of the Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin up to and including version 3.3.6.1 on WordPress sites are affected. Any WordPress website that uses one of these versions potentially exposes private download titles to unauthenticated users.

The CVSS score of 5.3 indicates a moderate confidentiality impact. An EPSS score of less than 1% suggests that the likelihood of exploitation is very low at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this weakness by sending a crafted AJAX request to the edd_ajax_get_download_title() endpoint without authenticating, making the attack vector straightforward while requiring no special prerequisites.