Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Discount Validation Bypass via PayPal Fastlane and Card Checkout
- ID
- WPSEC-2026-1070
- Plugin
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (easy-digital-downloads)
- Affected
- from 3.6.9 before 3.7.2
- Remediation
- Update to 3.7.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Easy Digital Downloads on WPSec AttackSurface
- Fix released
- Published
Description
The Easy Digital Downloads plugin for WordPress is vulnerable to a discount validation bypass via the PayPal Commerce Fastlane and card checkout REST endpoints in all versions up to, and including, 3.7.1.1, due to PurchaseUser::resolve() taking the discount code from the raw request body and never checking the cart's discounts again before the order is built, as the standard checkout does. This makes it possible for unauthenticated attackers to buy at a discounted price with codes that should be refused at purchase time (for example expired, used up, or already used by that customer), and to attach any existing discount code to their order, when the PayPal Commerce gateway is in use.
References
- https://wpsec.com/vuln/WPSEC-2026-1070/
- https://plugins.svn.wordpress.org/easy-digital-downloads/tags/3.7.2/
- https://wordpress.org/plugins/easy-digital-downloads/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS