CVE-2026-120538— Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture

Quick assessment

Affected

smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Easy Digital Downloads 插件存在身份验证绕过漏洞，可导致管理员账户被接管，该漏洞影响所有 3.7.2 及更早版本。在 PayPal 访客结账流程中，用户在访客结账字段输入的电子邮件地址被直接视为身份凭证：函数仅依据电子邮件地址匹配，就将新的访客订单与现有的 WordPress 用户绑定，并将订单的重写为该用户的 ID。随后，PayPal 捕获处理入口通过订单电子邮件地址查询用户（调用），当与该用户的 ID 一致时（此一致性由前述电子邮件绑定步骤保证），便会调用

CVSS 8.1 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture

Source: CVE Program / CVE List V5

Vulnerability Description

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

认证机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
smub	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy	0 ~ 3.7.2	-

II. Public POCs for CVE-2026-120538

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120538

请登录查看更多情报信息。

Other References for CVE-2026-120538 (7)

https://www.cve.org/CVERecord?id=CVE-2026-120538

IV. Related Vulnerabilities

Same product: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

Same vendor: smub

Same weakness: CWE-287