Easy Digital Downloads (<= 3.7.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/easy-digital-downloads--3.7.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 05:54:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEasy Digital Downloads: Authentication bypass in PayPal checkout (CVE-2026-120538)https://feed.craftedsignal.io/briefs/2026-11-edd-auth-bypass/Tue, 03 Nov 2026 05:54:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-edd-auth-bypass/The Easy Digital Downloads WordPress plugin is vulnerable to authentication bypass and account takeover due to insecure association of guest checkout orders with existing user accounts based on email address.The Easy Digital Downloads (EDD) plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-120538) affecting versions 3.7.2 and earlier. During guest checkout via PayPal, the plugin incorrectly trusts the provided email address to associate a guest order with an existing WordPress user account. The function edd_get_purchase_form_user() binds the order to an existing user if the provided email matches, and PurchaseUser::maybe_log_in_after_capture() subsequently calls wp_set_auth_cookie() to grant an authenticated session to that user. An unauthenticated attacker can exploit this by using a target administrator's email address during the PayPal purchase flow.

Attack Chain

  1. Attacker initiates a guest checkout session within the WordPress site using the target administrator's email address.
  2. The site application executes edd_get_purchase_form_user(), which identifies a match for the administrator's email in the WordPress user table.
  3. The order's user_id is updated to reflect the matched administrator's ID.
  4. The attacker completes the PayPal checkout process.
  5. The PurchaseUser::maybe_log_in_after_capture() function processes the payment capture.
  6. The plugin retrieves the user by the supplied email and validates the user_id match.
  7. The system automatically issues an authentication cookie for the administrator account via wp_set_auth_cookie().

Impact

Successful exploitation results in full administrative account takeover of the WordPress site.

Recommendation

  • Patch the Easy Digital Downloads plugin immediately. Upgrade to a version beyond 3.7.2.
  • Audit WordPress user session logs for anomalous login activity originating from recent PayPal checkout events.
  • Monitor for unexpected creation of administrative accounts or changes to existing user privileges.
]]>highadvisorywordpressvulnerabilityauthentication-bypass