Easy Digital Downloads - SQLi (CVE-2024-5057)

CVE-2024-5057 is a critical SQL injection vulnerability in Easy Digital Downloads versions up to 3.2.12, resulting from improper neutralization of special elements in SQL commands. This flaw allows remote, unauthenticated attackers to manipulate database queries, potentially exposing sensitive data and impacting the integrity and availability of affected WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 14th of January 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2024-5057 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. In addition, according to the CrowdSec network, attack volume against CVE-2024-5057 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending crafted requests to /wp-admin/admin-ajax.php with the action=edd_download_search parameter, injecting SQL payloads via the s parameter to execute arbitrary SQL commands.