CVE-2026-120538
Deferred Deferred - Pending Action

Authentication Bypass in Easy Digital Downloads Plugin

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Wordfence

Description
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120538

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated attacker to bypass authentication and take over an administrator account in WordPress sites using the Easy Digital Downloads plugin up to version 3.7.2. During PayPal guest checkout, the attacker enters an administrator's email address. The system trusts this email as proof of identity, links the order to the admin's account, and then automatically logs the attacker in as that admin without needing credentials.

Detection Guidance

Check for unauthorized administrator sessions or guest checkouts linked to admin emails. Review WordPress logs for PayPal-related transactions with mismatched user IDs. Inspect EDD plugin files for versions up to 3.7.2.

Impact Analysis

If you use the Easy Digital Downloads plugin on your WordPress site, an attacker could exploit this to gain full administrative access. This means they could take control of your site, install malicious software, steal data, or deface your website. The attack requires no prior access or credentials, making it particularly dangerous.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA requirements for data protection and access control. A breach could result in legal penalties, loss of customer trust, and potential fines for non-compliance with these regulations.

Mitigation Strategies

Update the Easy Digital Downloads plugin to the latest version. Disable guest checkout if not required. Monitor for suspicious admin account activities. Review and revoke unauthorized sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120538. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...