Easy Digital Downloads <= 3.7.2 — Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Easy Digital Downloads – eCommerce Payments and Subscriptions made easy.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 3.7.3, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Yuto Hyakumoto.

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Oct 30, 2026

   CVE published

   Severity high, CVSS 8.1

2. Nov 13, 2026

   Record last updated