Easy Digital Downloads: authentication bypass via PayPal checkout (CVE-2026-120538)
A vulnerability (CVSS 8.1) was found in the Easy Digital Downloads plugin for WordPress. During a PayPal guest checkout, the order is bound to an existing user by email match, and an authenticated session for that user is then issued.
Checked in Shield: no
Who is affected
All Easy Digital Downloads versions up to and including 3.7.2. An unauthenticated attacker can use an administrator's email, where that administrator has no EDD customer record, and complete a PayPal checkout to get an administrator session.
How to check
In the WordPress admin, open Plugins and look at the installed Easy Digital Downloads version. Version 3.7.2 or lower is affected.
How to fix
The source does not state a fixed version. Watch for a plugin update from the developer and install a release newer than 3.7.2 once it is available.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Exploitation status and the fixed version number are not disclosed yet; the source is the NVD entry.
