CVE-2026-66476

WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability

Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.

We have discovered 13,023 live websites that are affected by CVE-2026-66476.

Run a Free Instant Scan



Affected Software

Product  Easy Digital Downloads
Category Ecommerce
Vulnerable Domains13,023 live websites (100% of Easy Digital Downloads install base)
Vulnerable Versions
  • from 0 through 3.6.9
Vulnerable Versions Count151 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')



Details

  • Published - Jul 27, 2026
  • Updated - Jul 27, 2026

Credits

  • Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-66476
United States6,442 websites


Germany1,037 websites
GB730 websites
Iran545 websites
France514 websites
Italy387 websites
Cyprus336 websites
Canada249 websites
Japan232 websites
Australia225 websites

Website Distribution by TLD

Number of websites using CVE-2026-66476
.com8,065 websites
.org765 websites
.net439 websites
.de328 websites
.co.uk314 websites
.it248 websites
.com.au172 websites
.nl161 websites
.fr158 websites
.ca108 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-66476

Top websites that are affected by CVE-2026-66476. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.com United States*,***
***********.com United States*,***
***************.eu Netherlands*,***
********.com Germany*,***
**************.com Canada*,***
**********.com United States*,***
********.com United States*,***
************.com United States*,***
**********.com United States*,***
*************.com United States*,***
See full domain list

FAQ

CVE-2026-66476 is Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Easy Digital Downloads
A total of 13,023 websites have been identified as vulnerable to CVE-2026-66476, based on global website indexing conducted by WebTechSurvey.
The Easy Digital Downloads is affected by the CVE-2026-66476 vulnerability.
Easy Digital Downloads versions up to and including 3.6.9 are vulnerable to CVE-2026-66476.