{"id":"CVE-2026-120538","kind":"vulnerability","aliases":["CVE-2026-120538"],"related":[],"title":"WordPress Easy Digital Downloads: guest checkout logs attacker in as administrator","description":"The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.","summary":"The Easy Digital Downloads plugin binds a PayPal guest checkout to an existing WordPress user by matching only the email address, then issues that user a login session. An unauthenticated attacker who uses an administrator's email in a guest checkout gets a full administrator session.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["easy-digital-downloads","ecommerce","package","paypal","wordpress"],"not_affected_if":["paypal-not-enabled","plugin-not-installed","version-above-3.7.2"],"how_to_check":"- Check the installed Easy Digital Downloads plugin version in the WordPress admin under Plugins; versions up to and including `3.7.2` are described as affected.\n- Check whether the PayPal gateway is enabled in Downloads > Settings > Payment Gateways, since the flaw runs through the PayPal checkout, REST UnbrandedCard and Fastlane flows.","fix":"- Easy Digital Downloads: move to a version newer than `3.7.2`; the fixed version number is not stated in the sources.","status":"open","published_at":"2026-11-03T05:18:32+00:00","first_seen_at":"2026-11-03T05:48:52+00:00","triaged_at":"2026-11-03T05:49:51+00:00","updated_at":"2026-11-03T05:49:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T05:49:51Z","model":"claude-haiku-5-5","output":{"fix":"- Easy Digital Downloads: move to a version newer than `3.7.2`; the fixed version number is not stated in the sources.","reach":"internet","title":"WordPress Easy Digital Downloads: guest checkout logs attacker in as administrator","impact":"high","summary":"The Easy Digital Downloads plugin binds a PayPal guest checkout to an existing WordPress user by matching only the email address, then issues that user a login session. An unauthenticated attacker who uses an administrator's email in a guest checkout gets a full administrator session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","easy-digital-downloads","paypal","ecommerce"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker gains a full administrator session on the WordPress site.","analyst_note":"Find the fixed Easy Digital Downloads version and any vendor advisory; the sources give only the affected range up to and including 3.7.2.","how_to_check":"- Check the installed Easy Digital Downloads plugin version in the WordPress admin under Plugins; versions up to and including `3.7.2` are described as affected.\n- Check whether the PayPal gateway is enabled in Downloads > Settings > Payment Gateways, since the flaw runs through the PayPal checkout, REST UnbrandedCard and Fastlane flows.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","paypal-not-enabled","version-above-3.7.2"],"who_is_affected":"Sites running Easy Digital Downloads `3.7.2` or earlier that accept PayPal guest checkout. The flaw requires an administrator email with no existing EDD customer record, so the risk is highest where administrators have not bought anything through the store. Sites that do not use the plugin or the PayPal flows are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00079,"input_tokens":4407,"output_tokens":698,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120538':14A,17A '-2026':13A,16A '3.7.2':96C 'account':87C,241C 'address':46B,104C,138C,215C 'administr':11A,60B,70B,86C,212C,218C,238C 'attack':8A,56B,204C 'auth':200C 'authent':82C,195C,234C 'bind':31B,123C,190C 'bypass':83C 'captur':153C,160C 'checkout':6A,35B,66B,101C,110C,209C,252C 'complet':226C 'cooki':201C 'custom':223C 'cve':12A,15A 'digit':3A,20B,28B,74C 'download':4A,21B,29B,75C 'easi':2A,19B,27B,73C 'easy-digital-download':18B 'ecommerc':22B 'edd':118C,222C 'email':45B,62B,103C,137C,169C,173C,175C,189C,214C 'email-address':136C 'email-bind':188C 'enter':105C 'equal':181C 'exist':38B,130C,221C 'fastlan':258C 'field':111C 'flow':230C,259C 'form':121C 'full':69B,240C 'get':67B,119C,170C 'guarante':192C 'guest':5A,34B,65B,100C,109C,126C,208C 'guest-checkout':108C 'id':145C,150C,180C,185C 'ident':117C 'includ':95C 'issu':48B,193C 'lead':84C 'log':7A,157C 'login':52B 'look':162C 'match':42B,139C 'mayb':156C 'new':125C 'order':127C,142C,168C,174C,178C 'packag':23B 'paypal':24B,33B,99C,152C,228C,251C 'plugin':30B,76C 'proof':115C 'purchas':120C,229C 'purchaseus':155C 'pure':133C 'reachabl':247C 'receiv':232C 'record':224C 'rest':255C 'rewrit':140C 'session':53B,71B,196C,235C 'set':199C 'sink':154C,245C 'standard':250C 'start':206C 'step':191C 'takeov':88C,242C 'therefor':231C 'trust':113C 'unauthent':55B,203C 'unbrandedcard':256C 'use':58B,210C 'user':40B,50B,122C,132C,144C,148C,164C,171C,179C,183C 'version':91C 'vulner':80C 'wordpress':1A,25B,39B,78C,131C 'wp':198C","nicknames":[],"mitigations":[],"who_affected":"Sites running Easy Digital Downloads `3.7.2` or earlier that accept PayPal guest checkout. The flaw requires an administrator email with no existing EDD customer record, so the risk is highest where administrators have not bought anything through the store. Sites that do not use the plugin or the PayPal flows are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["easydigitaldownloads","ecommerce","high","package","paypal","wordpress"],"first_public_at":"2026-11-03T05:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120538","severity":null,"published_at":"2026-11-03T05:18:32+00:00","modified_at":"2026-11-03T05:18:32+00:00","first_seen_at":"2026-11-03T05:48:52+00:00","fetched_at":"2026-11-03T05:48:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}