CVE-2026-120538
HighCVSS 8.1Summary
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered is trusted as proof of identity, allowing an unauthenticated attacker to obtain an authenticated session as an administrator.
Risk Assessment
An unauthenticated attacker can achieve full administrator account takeover, leading to complete site compromise. This requires using an administrator's email address without an existing EDD customer record.
Recommendation
Update the plugin to a version later than 3.7.2. Until updated, consider disabling PayPal guest checkout or implementing additional verification.
Other vulnerabilities in Easy Digital Downloads
See all- CVE-2026-116403Medium
The Easy Digital Downloads WordPress plugin (through version 3.7.1) contains a race condition vulnerability due to improper synchronization of shared resources. This may allow an attacker to leverage race conditions.
- CVE-2026-14335High
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 is vulnerable to Stored Cross-Site Scripting (XSS) via PayPal IPN parameters. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-105190Medium
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.
- CVE-2026-105194Medium
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
- CVE-2026-42638High
Missing Authorization vulnerability in Easy Digital Downloads allows exploiting incorrectly configured access control security levels. Affects versions through 3.7.1.
- CVE-2026-95522High
The Easy Digital Downloads plugin in versions up to and including 3.7.0 contains an SQL Injection vulnerability accessible to users with the Shop manager role. This allows injection of malicious SQL code into database queries.
- CVE-2026-12476High
The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.
- CVE-2026-66476Medium
Administrator Arbitrary File Deletion in Easy Digital Downloads versions up to 3.6.9.
- CVE-2026-59524Medium
Easy Digital Downloads plugin version 3.6.7 and earlier contains a broken authentication vulnerability that does not require authentication. An attacker can gain unauthorized access to administrative functions.
- CVE-2026-39503High
Easy Digital Downloads versions up to 3.6.5 have a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS