# Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.2 - Unauthenticated Authentication Bypass via PayPal Order Capture

- **ID:** WPSEC-2026-2153
- **Plugin:** Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (`easy-digital-downloads`), https://wordpress.org/plugins/easy-digital-downloads/
- **Affected versions:** all versions before 3.7.3
- **Fixed in:** 3.7.3 (Update to 3.7.3 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/easy-digital-downloads
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2153/

## Description

The Easy Digital Downloads plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.7.2. This is due to the maybe_log_in_after_capture() function issuing a WordPress authentication cookie, when a PayPal order is captured, to the user whose email address and user ID are on the order, without checking that the current session authenticated as that user. A guest order placed with the email address of an existing account that has no customer record is assigned to that account once its owner follows the account verification link the store then emails them, even if the order has not been paid yet. This makes it possible for unauthenticated attackers to place a guest PayPal order using the email address of an existing user, such as an administrator, and, after that user verifies their account, complete the payment and be logged in as that user. Exploitation requires guest checkout and the PayPal gateway to be enabled, and the target account must not already have a customer record.

## References

- https://wpsec.com/vuln/WPSEC-2026-2153/
- https://plugins.svn.wordpress.org/easy-digital-downloads/tags/3.7.3/
- https://wordpress.org/plugins/easy-digital-downloads/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2153/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.