{
 "id": "WPSEC-2026-1070",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1070/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1070/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1070/index.md",
 "title": "Easy Digital Downloads <= 3.7.1.1 - Unauthenticated Discount Validation Bypass via PayPal Fastlane and Card Checkout",
 "description": "The Easy Digital Downloads plugin for WordPress is vulnerable to a discount validation bypass via the PayPal Commerce Fastlane and card checkout REST endpoints in all versions up to, and including, 3.7.1.1, due to PurchaseUser::resolve() taking the discount code from the raw request body and never checking the cart's discounts again before the order is built, as the standard checkout does. This makes it possible for unauthenticated attackers to buy at a discounted price with codes that should be refused at purchase time (for example expired, used up, or already used by that customer), and to attach any existing discount code to their order, when the PayPal Commerce gateway is in use.",
 "plugin": {
  "slug": "easy-digital-downloads",
  "name": "Easy Digital Downloads",
  "full_name": "Easy Digital Downloads – eCommerce Payments and Subscriptions made easy",
  "wordpress_org": "https://wordpress.org/plugins/easy-digital-downloads/",
  "advisories_url": "https://wpsec.com/vuln/plugin/easy-digital-downloads/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/easy-digital-downloads"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.6.9",
    "from_inclusive": true,
    "to": "3.7.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.6.9 before 3.7.2"
  ]
 },
 "introduced_in": "3.6.9",
 "fixed_in": "3.7.2",
 "remediation": "Update to 3.7.2 or later.",
 "fix_released": "2026-10-14T22:45:10+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T10:56:05.111647+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1070/",
  "https://plugins.svn.wordpress.org/easy-digital-downloads/tags/3.7.2/",
  "https://wordpress.org/plugins/easy-digital-downloads/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/easy-digital-downloads",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}