CVE-2025-2252: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure
Vulnerability summary
CVE-2025-2252 is a medium (CVSS 5.3) vulnerability in awesomemotive easy_digital_downloads. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.3% of scored vulnerabilities.
Timeline
- 25-03-2025PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the edd_ajax_get_download_title() function. This makes it possible for unauthenticated attackers to extract private post titles of downloads. The impact here is minimal.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.38% on 23-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Awesomemotive1 product
- easy_digital_downloads< 3.3.7
Smub1 product
Wordpress1 product
- easy-digital-downloads≤ 3.3.6.1 (fixed in 3.3.7)
3 vendors · 3 products