{"id":"CVE-2026-116403","kind":"vulnerability","aliases":["CVE-2026-116403"],"related":[],"title":"Easy Digital Downloads: race condition in shared resource handling through 3.7.1","description":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.","summary":"Easy Digital Downloads, a WordPress e-commerce plugin, has a race condition in how it handles a shared resource, per the NVD entry. The sources do not say what an attacker gets beyond the race, so the practical impact is unknown.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["easy-digital-downloads","ecommerce","package","wordpress"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Easy Digital Downloads version in the WordPress admin plugins list or with `wp plugin get easy-digital-downloads --field=version`\n- unknown for anything more specific, since the sources do not say which feature or endpoint is affected","fix":"- Update Easy Digital Downloads to a version later than `3.7.1`\n- unknown for the exact fixed version, since the sources do not name it","status":"open","published_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:21+00:00","updated_at":"2026-10-26T17:33:21+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-26T17:33:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update Easy Digital Downloads to a version later than `3.7.1`\n- unknown for the exact fixed version, since the sources do not name it","reach":"unknown","title":"Easy Digital Downloads: race condition in shared resource handling through 3.7.1","impact":"medium","summary":"Easy Digital Downloads, a WordPress e-commerce plugin, has a race condition in how it handles a shared resource, per the NVD entry. The sources do not say what an attacker gets beyond the race, so the practical impact is unknown.","category":"package","nicknames":[],"who_cares":["wordpress","easy-digital-downloads","ecommerce"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources only describe a race condition","analyst_note":"Check the NVD entry and the Easy Digital Downloads changelog for the fixed version and the affected code path, since the sources give no detail beyond the CVSS score.","how_to_check":"- Check the installed Easy Digital Downloads version in the WordPress admin plugins list or with `wp plugin get easy-digital-downloads --field=version`\n- unknown for anything more specific, since the sources do not say which feature or endpoint is affected","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running Easy Digital Downloads version 3.7.1 or earlier are in the affected range according to NVD. The sources do not say which configuration or feature triggers the race, so whether a given store is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3325,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116403':14A,17A '-2026':13A,16A '3.7.1':11A,99C 'affect':92C 'allow':87C 'attack':56B 'awesomemot':79C 'beyond':58B 'commerc':32B 'concurr':67C 'condit':5A,37B,76C 'conditions.this':90C 'cve':12A,15A 'digit':2A,20B,26B,81C,85C,94C 'download':3A,21B,27B,82C,86C,95C 'e':31B 'e-commerc':30B 'easi':1A,19B,25B,80C,84C,93C 'easy-digital-download':18B,83C 'ecommerc':22B 'entri':48B 'execut':68C 'get':57B 'handl':9A,41B 'impact':64B 'improp':73C 'issu':91C 'leverag':88C 'n/a':97C 'nvd':47B 'packag':23B 'per':45B 'plugin':33B 'practic':63B 'race':4A,36B,60B,75C,89C 'resourc':8A,44B,71C 'say':53B 'share':7A,43B,70C 'sourc':50B 'synchron':74C 'unknown':66B 'use':69C 'vulner':77C 'wordpress':24B,29B","nicknames":[],"mitigations":[],"who_affected":"Sites running Easy Digital Downloads version 3.7.1 or earlier are in the affected range according to NVD. The sources do not say which configuration or feature triggers the race, so whether a given store is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116403","severity":null,"published_at":"2026-10-26T17:17:26+00:00","modified_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}