CVE-2026-120538— Easy Digital Downloads 3.7.2 远程账户接管漏洞
一分钟漏洞结论
影响对象
smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
WordPress 的 Easy Digital Downloads 插件存在身份验证绕过漏洞，可导致管理员账户被接管，该漏洞影响所有 3.7.2 及更早版本。在 PayPal 访客结账流程中，用户在访客结账字段输入的电子邮件地址被直接视为身份凭证： 函数仅依据电子邮件地址匹配，就将新的访客订单与现有的 WordPress 用户绑定，并将订单的 重写为该用户的 ID。随后，PayPal 捕获处理入口 通过订单电子邮件地址查询用户（调用 ），当 与该用户的 ID 一致时（此一致性由前述电子邮件绑定步骤保证），便会调用
可能的 ATT&CK 技术 1 AI
T1190 · Exploit Public-Facing Application
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-120538 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
来源: CVE Program / CVE List V5
Vulnerability Description
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| smub | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 0 ~ 3.7.2 | - |
|
二、漏洞 CVE-2026-120538 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-120538 的情报信息
请登录查看更多情报信息。