Easy Digital Downloads plugin flaw allows administrator account takeover

Attackers can take over administrator accounts in a WordPress shop plugin.

Summary

A PayPal guest checkout trusts an email address as proof of identity, so an unauthenticated attacker can log in as an administrator. All versions up to and including 3.7.2 are affected.

Affected when

PayPal guest checkout in use
Administrator email has no existing EDD customer record

What to do

All versions up to and including 3.7.2 are affected. Check that the plugin is newer than that bound and read the vendor's advisory.

Products and platforms

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

CVE IDs

CVE-2026-120538 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 04:43 UTC

First seen 2026-11-09 14:10 UTC