The vulnerability is an unauthenticated broken authentication flaw in Easy Digital Downloads up to version 3.6.7. Attackers can exploit this weakness without authentication, potentially gaining the privileges of an administrator and accessing store‑management functions. The weakness is classified as CWE‑288, indicating insufficient or missing authentication controls. Based solely on the supplied description, no additional credentials or special conditions are required for exploitation.

Sandhills Development’s Easy Digital Downloads plugin is affected for all releases up to and including 3.6.7. WordPress sites that are running any of these vulnerable plugin versions are at risk. Users running the plugin on any version beyond 3.6.7 are not affected by this particular flaw.

The CVSS score of 6.5 places the flaw in the Medium severity range, reflecting the potential for unauthorized access. The EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote via the WordPress plugin’s public interface, allowing attackers to bypass authentication without any prior privilege.