CVE-2026-105190
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 08, 2026
Vendor
unknown
Description
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.