CVE-2026-120538 in Easy Digital Downloads Plugin
Summary
by MITRE • 11/03/2026
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Easy Digital Downloads versions up to 3.7.2 represents a critical authentication bypass flaw rooted in flawed identity verification logic during payment processing workflows. This issue specifically affects systems utilizing PayPal integration, including standard checkout, REST UnbrandedCard, and Fastlane flows. The core technical failure lies in the assumption that an email address constitutes sufficient proof of identity for account association. During a guest checkout process, the function edd_get_purchase_form_user() binds a new order to an existing WordPress user based solely on an exact match of the provided email address. This mechanism blindly rewrites the order's user_id field to correspond with the ID of any registered user sharing that email, without verifying ownership or requiring additional authentication factors such as password confirmation or two-factor verification.
The exploitation chain is completed by the PayPal capture sink function PurchaseUser::maybe_log_in_after_capture(). After a payment transaction is successfully captured via PayPal, this function retrieves the associated WordPress user using get_user_by with the order's email address. Because the previous step guaranteed that the order's user_id matches the ID of the user found by that email, the condition for automatic login is satisfied. Consequently, the system issues an authenticated session cookie via wp_set_auth_cookie() without any further validation. This logic flaw allows an unauthenticated attacker to hijack administrative privileges simply by initiating a guest checkout with an administrator’s email address and completing the PayPal purchase flow, provided the target administrator does not already have an existing Easy Digital Downloads customer record that might interfere with the binding process.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to adequately verify identity before granting access privileges. It also relates to CWE-640 Weak Password Recovery Mechanism for Forgotten Password in terms of relying on email alone for account linkage and recovery-like actions without secondary verification. In the context of the MITRE ATT&CK framework, this flaw facilitates Account Manipulation (T1098) by allowing an attacker to establish persistent access through credential-based authentication bypasses, specifically leveraging valid credentials or identity claims that are not properly validated against actual user ownership. The impact is severe, resulting in full account takeover and potential compromise of the entire WordPress installation if administrative privileges are exploited for further lateral movement or data exfiltration.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately update Easy Digital Downloads to version 3.7.3 or later where this logic has been corrected to prevent automatic session creation based solely on email matching during payment capture. In the interim, if updating is not feasible, administrators can disable PayPal guest checkout options or restrict user registration by email to mitigate exposure. Furthermore, implementing multi-factor authentication for all administrative accounts adds a critical layer of defense that would neutralize this specific bypass vector even if an attacker successfully triggers the session creation logic. Security audits should also review other areas where email addresses are used as primary identifiers for sensitive operations to prevent similar logical flaws in future integrations or custom code modifications.