Technical impact
This vulnerability occurs when concurrent execution on a shared resource inside the Awesomemotive Easy Digital Downloads plugin is not properly synchronized. The result is a race condition that allows an attacker to trigger overlapping requests, potentially leading to unintended operations or data corruption. The weakness is identified as CWE-362, which reflects improper handling of concurrent access to shared data.
Affected Systems
The flaw affects installations of the WordPress Easy Digital Downloads plugin up to version 3.7.1. Any WordPress site that has not yet applied the latest plugin update remains vulnerable, regardless of whether the plugin is used for sales, downloads, or both.
Risk and Exploitability
The CVSS score of 5.9 signals a moderate severity level. No EPSS score is provided, so the probability of exploitation cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog, indicating that no compromised systems were reported in the wild. The likely attack vector is inferred to be a carefully timed set of concurrent HTTP requests that exploit the lack of mutual exclusion, a scenario that would require some attacker skill to coordinate but does not demand privileged access. While no public exploit is known, the absence of mitigation mechanisms in the affected plugin makes the risk realistic if an attacker can trigger the race condition.
