Summary
An authentication bypass vulnerability exists in the Easy Digital Downloads plugin for WordPress. This flaw allows an unauthenticated attacker to take over an administrator account. The vulnerability affects Easy Digital Downloads versions 3.7.2 and earlier. A patch is available in version 3.7.3. There is no evidence of active exploitation.
Affected and patched versions
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (plugin easy-digital-downloads): affected 3.7.2 and earlier; fixed in 3.7.3
Is my site vulnerable?
To determine if your WordPress site is vulnerable, check the version of the Easy Digital Downloads plugin currently installed.
Log in to your WordPress administrator dashboard.
Navigate to the "Plugins" section, then click "Installed Plugins".
Locate "Easy Digital Downloads – eCommerce Payments and Subscriptions made easy" in the list.
The version number is displayed next to the plugin name.
If your installed version of Easy Digital Downloads is 3.7.2 or earlier, your site is vulnerable to this issue. Sites running version 3.7.3 or higher are not affected by this specific vulnerability.
What an attacker actually does
An unauthenticated attacker can exploit this vulnerability to gain full control of an administrator's account on a WordPress site running the Easy Digital Downloads plugin. The attack begins with the attacker initiating a guest checkout process through PayPal on the vulnerable site. During this checkout, the attacker provides the email address of an existing site administrator. This attack is effective if the targeted administrator does not already have an existing customer record within Easy Digital Downloads.
The core of the vulnerability lies in how the plugin handles identity during a PayPal guest checkout. The edd_get_purchase_form_user() function, responsible for processing user information during a purchase, trusts the email address entered in the guest-checkout field as sufficient proof of identity. It then attempts to bind the new guest order to an existing WordPress user. If it finds a WordPress user with an email address matching the one provided by the attacker (which is the administrator's email), it incorrectly rewrites the order's user_id to that administrator's ID. This action occurs without any further authentication or verification of the user's true identity.
Following this initial binding, the attacker proceeds to complete the PayPal purchase. Once the payment is captured, the plugin's PayPal capture sink, specifically the PurchaseUser::maybe_log_in_after_capture() function, is triggered. This function looks up the user associated with the order by the order email. Because the previous step already ensured that the order's user_id now matches the administrator's ID, this function then issues an authenticated session using wp_set_auth_cookie(). Consequently, the attacker receives an authenticated session as the targeted administrator, effectively taking over the administrator's account. This authentication bypass is also reachable through the standard PayPal checkout, as well as the REST UnbrandedCard and Fastlane payment flows.
How to detect a compromise
Detecting a compromise related to CVE-2026-120538 involves reviewing user activity, order records, and system logs for unusual patterns, particularly those associated with administrator accounts and Easy Digital Downloads transactions.
Look for unexpected administrator logins that do not correspond to known legitimate activity. This might manifest as an administrator account being active from an unfamiliar IP address or at unusual times. Review your WordPress security logs, if enabled, for wp_set_auth_cookie() calls that are not preceded by a standard login attempt, especially if they follow a PayPal transaction completion.
Examine the Easy Digital Downloads order records within your WordPress dashboard. Specifically, look for guest purchases where the email address used for the guest checkout matches a known administrator's email. Pay close attention to the IP address and user agent associated with these orders. An order initiated by an unknown or suspicious IP address, but linked to an administrator's email, could indicate an attempted or successful exploit.
Investigate the edd_orders database table for entries where the user_id value has been unexpectedly changed or assigned to an existing administrator user after a guest checkout. This would be unusual if the administrator did not explicitly make a guest purchase. Additionally, review the wp_users and wp_usermeta tables for any recent, unauthorized modifications to administrator accounts, such as changes to email addresses, passwords, or capabilities.
Monitor for any new administrator accounts created without proper authorization. While this vulnerability specifically allows for takeover of an existing administrator account, an attacker might create new accounts as a persistence mechanism. Any unusual activity performed by an administrator account, such as the installation of new plugins, modification of theme files, or changes to site content that are not part of planned operations, should be investigated.
How to fix
To address the CVE-2026-120538 vulnerability, follow these steps:
Update the Easy Digital Downloads plugin: Immediately update your Easy Digital Downloads plugin to version 3.7.3 or higher. This version contains the necessary patch to resolve the authentication bypass vulnerability. You can update the plugin through your WordPress administrator dashboard under "Plugins" -> "Installed Plugins".
Review administrator accounts: After updating, carefully review all administrator accounts on your WordPress site. Check for any unauthorized changes to user profiles, such as altered email addresses, new passwords, or unexpected user roles.
Rotate administrator passwords: As a precautionary measure, consider requiring all administrators to change their passwords. This helps mitigate risks if an administrator's email was used in an attempted exploit before the patch was applied.
Timeline
Date | Event |
|---|---|
2026-10-30 | Public publication |
2026-11-02 | NVD record published |