---
id: "CVE-2026-120538"
kind: "vulnerability"
aliases: ["CVE-2026-120538"]
title: "WordPress Easy Digital Downloads: guest checkout logs attacker in as administrator"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["easy-digital-downloads", "ecommerce", "package", "paypal", "wordpress"]
not_affected_if: ["paypal-not-enabled", "plugin-not-installed", "version-above-3.7.2"]
published_at: "2026-11-03T05:18:32+00:00"
first_seen_at: "2026-11-03T05:48:52+00:00"
updated_at: "2026-11-03T05:49:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120538", "first_seen_at": "2026-11-03T05:48:52+00:00"}]
---

# WordPress Easy Digital Downloads: guest checkout logs attacker in as administrator

The Easy Digital Downloads plugin binds a PayPal guest checkout to an existing WordPress user by matching only the email address, then issues that user a login session. An unauthenticated attacker who uses an administrator's email in a guest checkout gets a full administrator session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Easy Digital Downloads plugin version in the WordPress admin under Plugins; versions up to and including `3.7.2` are described as affected.
- Check whether the PayPal gateway is enabled in Downloads > Settings > Payment Gateways, since the flaw runs through the PayPal checkout, REST UnbrandedCard and Fastlane flows.

## Fix

- Easy Digital Downloads: move to a version newer than `3.7.2`; the fixed version number is not stated in the sources.

## Timeline

- 2026-11-03T05:48:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120538

## From the sources

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_