The vulnerability exists because the Easy Digital Downloads plugin’s edd_sendwp_disconnect() and edd_sendwp_remote_install() functions omit the required nonce validation. An unauthenticated attacker can construct a forged request that, when executed by a logged‑in site administrator, will either deactivate the plugin or install and activate the SendWP plugin. This may lead to loss of eCommerce functionality or unintended plugin behavior without the administrator’s knowledge.

All installations of the Easy Digital Downloads WordPress plugin version 3.5.0 or earlier issued by the SMUB vendor are affected. The vulnerability applies to any site using that plugin, whether the administrator performs the action through a browser or via a malicious link.

The CVSS score of 5.4 indicates moderate severity, but the EPSS score of less than 1% suggests a low probability of real‑world exploitation at present. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is most likely social‑engineering: an attacker must trick an administrator into clicking a crafted link that triggers the missing‑nonce request. Once the administrator’s session is used, the plugin can be deactivated, or the SendWP plugin can be force‑installed and activated on the site.