Medium · 6.5 CVE-2026-94590 EUVD-2026-96397GHSA-x82p-jjvx-r7fg

WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability

Published Oct 10, 2026 · Updated Oct 11, 2026 · Assigned by Patchstack

Vendor: CodePeople2 Product: Sell Downloads

Description

Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3.

Affected products

Vendor	Product	Affected	Fixed
CodePeople2	Sell Downloads	≤ 1.2.3	—

References

https://patchstack.com/database/wordpress/plugin/sell-downloads/vulnerability/wordpress-sell-downloads-plugin-1-2-3-broken-access-control-vulnerability?_s_id=cve vdb-entry