Codepeople Sell Downloads vulnerabilities

2 CVEs affecting Codepeople Sell Downloads, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-68850, published 2026-01-05.

More from Codepeople.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-9348, published 2019-08-27. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
• CVE-2025-68850, published 2026-01-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Missing Authorization vulnerability in codepeople Sell Downloads sell-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sell Downloads: from n/a…