Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.2 - Unauthenticated Authentication Bypass via PayPal Order Capture
- ID
- WPSEC-2026-2153
- Plugin
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (easy-digital-downloads)
- Affected
- all versions before 3.7.3
- Remediation
- Update to 3.7.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy on WPSec AttackSurface
- Fix released
- Published
Description
The Easy Digital Downloads plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.7.2. This is due to the maybe_log_in_after_capture() function issuing a WordPress authentication cookie, when a PayPal order is captured, to the user whose email address and user ID are on the order, without checking that the current session authenticated as that user. A guest order placed with the email address of an existing account that has no customer record is assigned to that account once its owner follows the account verification link the store then emails them, even if the order has not been paid yet. This makes it possible for unauthenticated attackers to place a guest PayPal order using the email address of an existing user, such as an administrator, and, after that user verifies their account, complete the payment and be logged in as that user. Exploitation requires guest checkout and the PayPal gateway to be enabled, and the target account must not already have a customer record.
References
- https://wpsec.com/vuln/WPSEC-2026-2153/
- https://plugins.svn.wordpress.org/easy-digital-downloads/tags/3.7.3/
- https://wordpress.org/plugins/easy-digital-downloads/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS