{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/easy-digital-downloads--3.7.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:easydigitaldownloads:easy_digital_downloads:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-120538"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Easy Digital Downloads (\u003c= 3.7.2)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Easy Digital Downloads"],"content_html":"\u003cp\u003eThe Easy Digital Downloads (EDD) plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-120538) affecting versions 3.7.2 and earlier. During guest checkout via PayPal, the plugin incorrectly trusts the provided email address to associate a guest order with an existing WordPress user account. The function \u003ccode\u003eedd_get_purchase_form_user()\u003c/code\u003e binds the order to an existing user if the provided email matches, and \u003ccode\u003ePurchaseUser::maybe_log_in_after_capture()\u003c/code\u003e subsequently calls \u003ccode\u003ewp_set_auth_cookie()\u003c/code\u003e to grant an authenticated session to that user. An unauthenticated attacker can exploit this by using a target administrator's email address during the PayPal purchase flow.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker initiates a guest checkout session within the WordPress site using the target administrator's email address.\u003c/li\u003e\n\u003cli\u003eThe site application executes \u003ccode\u003eedd_get_purchase_form_user()\u003c/code\u003e, which identifies a match for the administrator's email in the WordPress user table.\u003c/li\u003e\n\u003cli\u003eThe order's \u003ccode\u003euser_id\u003c/code\u003e is updated to reflect the matched administrator's ID.\u003c/li\u003e\n\u003cli\u003eThe attacker completes the PayPal checkout process.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ePurchaseUser::maybe_log_in_after_capture()\u003c/code\u003e function processes the payment capture.\u003c/li\u003e\n\u003cli\u003eThe plugin retrieves the user by the supplied email and validates the \u003ccode\u003euser_id\u003c/code\u003e match.\u003c/li\u003e\n\u003cli\u003eThe system automatically issues an authentication cookie for the administrator account via \u003ccode\u003ewp_set_auth_cookie()\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative account takeover of the WordPress site.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the Easy Digital Downloads plugin immediately. Upgrade to a version beyond 3.7.2.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user session logs for anomalous login activity originating from recent PayPal checkout events.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected creation of administrative accounts or changes to existing user privileges.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T05:54:40Z","date_published":"2026-11-03T05:54:40Z","id":"https://feed.craftedsignal.io/briefs/2026-11-edd-auth-bypass/","summary":"The Easy Digital Downloads WordPress plugin is vulnerable to authentication bypass and account takeover due to insecure association of guest checkout orders with existing user accounts based on email address.","title":"Easy Digital Downloads: Authentication bypass in PayPal checkout (CVE-2026-120538)","url":"https://feed.craftedsignal.io/briefs/2026-11-edd-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Easy Digital Downloads (\u003c= 3.7.2)","version":"https://jsonfeed.org/version/1.1"}