CVE-2025-2252: 
WordPress vulnerability analysis and mitigation

The Easy Digital Downloads (EDD) – eCommerce Payments and Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 3.3.6.1. The vulnerability exists in the eddajaxgetdownloadtitle() function, which allows unauthenticated attackers to extract private post titles of downloads (NVD).

The vulnerability is present in the eddajaxgetdownloadtitle() function within the ajax-functions.php file. The function fails to properly validate user permissions before revealing download titles, allowing unauthorized users to access potentially sensitive information. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD, Wordfence).

The impact of this vulnerability is considered minimal but could allow attackers to view private download titles that should not be publicly accessible. This could potentially expose sensitive information about unpublished or private products (NVD).

The vulnerability has been patched in version 3.3.7 of the Easy Digital Downloads plugin. The fix includes additional permission checks and validation in the eddajaxgetdownloadtitle() function. Users are advised to update to the latest version of the plugin (WordPress Plugin).