An attacker can take over an administrator's account on a WordPress site running the Easy Digital Downloads plugin by exploiting a flaw in how the plugin…
Affected component: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (plugin)
Fixed in: 3.7.3
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since November 4, 2026. No PowerSEC firewall rule blocks this attack. Update to 3.7.3 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-120538