The Easy Digital Downloads plugin allows arbitrary files to be uploaded because the upload handler verifies only the MIME type supplied by the client and then writes the file with its original extension without additional validation. This flaw enables an attacker to place executable files on the server’s web‑accessible directory, potentially leading to remote code execution if the uploaded file is accessed. The weakness is a classic insufficient input validation vulnerability captured by CWE‑434.

The affected vendor is smub’s Easy Digital Downloads eCommerce Payments and Subscriptions plugin, version 3.6.9 and any previous releases. Users running any of these versions on a WordPress site are at risk. Only authenticated users with Shop Manager or higher privileges can exploit the flaw, as the upload endpoint is protected by the plugin’s role checks.

The CVSS score of 7.2 indicates a high impact potential, while the EPSS score of less than 1% suggests that exploitation is unlikely but possible. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need legitimate site access with sufficient role permissions and would upload a crafted file, which the server then serves from the wp-content/uploads directory. If the uploaded file is executable, remote code execution becomes feasible. Due to the authenticated nature of the vector, the threat primarily applies to insiders or compromised accounts rather than public users.