Advisory · CVE-2026-120538
Easy Digital Downloads PayPal guest checkout allows administrator account takeover
Easy Digital Downloads up to and including 3.7.2 trusts a guest checkout email as proof of identity, so an unauthenticated attacker who completes a PayPal purchase with an administrator email receives an authenticated session as that administrator.
- Vendor
- Easy Digital Downloads
- Product
- Easy Digital Downloads
- Identifier / CWE
- CVE-2026-120538
CWE-287 - Action timing
- Immediate
Explain it like I’m five
The store asks a guest buyer for an email address and believes whoever types it. An attacker types the administrators email, pays through PayPal, and the store hands them the administrators session as a thank you.
- 01Guest checkout started
An unauthenticated attacker starts a PayPal guest checkout using an administrators email address, where that administrator has no existing Easy Digital Downloads customer record.
- 02Email bound to existing user
The guest order is bound to the existing WordPress user purely on an email address match, rewriting the order user ID to that users ID.
- 03Capture sink logs in
The PayPal capture handler looks the user up by the order email and, finding the IDs match, issues an authenticated session for that user.
- 04Administrator session obtained
The attacker receives a session as the administrator, a full account takeover of the site.
What happened
Easy Digital Downloads versions up to and including 3.7.2 contain an authentication bypass vulnerability in PayPal guest checkout. During a PayPal guest checkout, the email address entered in the guest checkout field is trusted as proof of identity: the guest order is bound to an existing WordPress user purely on an email address match, and the PayPal capture handler then issues an authenticated session for that user. An unauthenticated attacker who starts a guest checkout using an administrators email address and completes the PayPal purchase flow therefore receives a session as that administrator. The record rates it high at CVSS 8.1.
The takeover precondition is specific: it applies where the administrator has no existing Easy Digital Downloads customer record. The same login sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows, not only guest checkout. WordPress.org lists version 3.7.3, updated November 2, 2026, as current, outside the stated affected range. Easy Digital Downloads reports over 50,000 stores and more than 30 million orders processed, so a checkout authentication flaw here sits directly on revenue infrastructure.
What to do
- Inventory WordPress sites running Easy Digital Downloads and record each version.
- Update to Easy Digital Downloads 3.7.3 or later.
- Until updated, review PayPal guest checkout orders for email addresses matching administrator accounts, and consider disabling guest checkout.
- Review authentication logs for administrator sessions created immediately after PayPal guest purchases, and force password resets plus session invalidation if a takeover cannot be excluded.
- Verify the deployed version after updating.
Management note
An email address is an identifier, not a credential, and checkout is exactly where that distinction gets tested. Any flow that converts a purchase into a login session needs to prove identity some other way, or it hands the store keys to whoever can type an address and pay.