Easy Digital Downloads: Authentication bypass in PayPal checkout (CVE-2026-120538)

The Easy Digital Downloads (EDD) plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-120538) affecting versions 3.7.2 and earlier. During guest checkout via PayPal, the plugin incorrectly trusts the provided email address to associate a guest order with an existing WordPress user account. The function edd_get_purchase_form_user() binds the order to an existing user if the provided email matches, and PurchaseUser::maybe_log_in_after_capture() subsequently calls wp_set_auth_cookie() to grant an authenticated session to that user. An unauthenticated attacker can exploit this by using a target administrator's email address during the PayPal purchase flow.

Attack Chain

1. Attacker initiates a guest checkout session within the WordPress site using the target administrator's email address.
2. The site application executes edd_get_purchase_form_user(), which identifies a match for the administrator's email in the WordPress user table.
3. The order's user_id is updated to reflect the matched administrator's ID.
4. The attacker completes the PayPal checkout process.
5. The PurchaseUser::maybe_log_in_after_capture() function processes the payment capture.
6. The plugin retrieves the user by the supplied email and validates the user_id match.
7. The system automatically issues an authentication cookie for the administrator account via wp_set_auth_cookie().

Impact

Successful exploitation results in full administrative account takeover of the WordPress site.

Recommendation

• Patch the Easy Digital Downloads plugin immediately. Upgrade to a version beyond 3.7.2.
• Audit WordPress user session logs for anomalous login activity originating from recent PayPal checkout events.
• Monitor for unexpected creation of administrative accounts or changes to existing user privileges.