Missing Authorization vulnerability in the Awesomemotive Easy Digital Downloads plugin allows unauthenticated users to exploit incorrectly configured access control security levels. The flaw enables bypass of the plugin’s intended restrictions, potentially allowing unauthorized access to protected functions or data accessed through the plugin’s HTTP endpoints. This constitutes a classic access control bypass (CWE‑862).

Awesomemotive Easy Digital Downloads for WordPress, versions from the plugin’s earliest release up through 3.7.1, are affected. Any WordPress site that has this plugin installed at or below version 3.7.1 is vulnerable. The issue does not affect later releases starting with 3.7.1.1.

The CVSS score of 7.5 indicates a high severity issue. The EPSS score of < 1 % suggests a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw from any remote host by sending HTTP requests to the plugin’s publicly exposed endpoints, thereby bypassing authentication checks. No particular privilege or network conditions are required beyond a basic HTTP connection.