Authentication Bypass Vulnerability in Easy Digital Downloads Plugin for WordPress

CVE-2026-120538

What is CVE-2026-120538?

The Easy Digital Downloads plugin for WordPress contains an authentication bypass vulnerability that allows an attacker to take control of an administrator account. This occurs during the PayPal guest checkout process, where an email address entered in the checkout field is incorrectly trusted. The plugin matches this email to an existing WordPress user, enabling the attacker to initiate a purchase flow with the administrator's email address without their consent. If successful, this leads to the issuance of an authenticated session, allowing complete administrative access to the site. This vulnerability affects all versions up to 3.7.2 and can be exploited through the standard PayPal checkout and other associated payment flows.

References