Live › vulnerability › CVE-2026-120538
The Easy Digital Downloads plugin binds a PayPal guest checkout to an existing WordPress user by matching only the email address, then issues that user a login session. An unauthenticated attacker who uses an administrator's email in a guest checkout gets a full administrator session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 05:48 UTC. All times on this page are UTC.
Sites running Easy Digital Downloads 3.7.2 or earlier that accept PayPal guest checkout. The flaw requires an administrator email with no existing EDD customer record, so the risk is highest where administrators have not bought anything through the store. Sites that do not use the plugin or the PayPal flows are not described as affected.
No product ranges from the sources yet.
3.7.2 are described as affected.3.7.2; the fixed version number is not stated in the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.
This page as .md · .json · in your agent: get_signal("CVE-2026-120538")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.