Easy Digital Downloads through 3.7.2 - Unauthenticated Administrator Account Takeover

Easy Digital Downloads through 3.7.2 contains an unauthenticated PayPal guest-checkout authentication bypass that can lead to administrator account takeover. Update to 3.7.3.

Easy Digital Downloads versions up to and including 3.7.2 are vulnerable to an unauthenticated authentication bypass that can lead to administrator account takeover. The flaw is tied to PayPal guest checkout identity handling. Easy Digital Downloads 3.7.3 strengthens account verification when a PayPal order completes and is the fixed release.

Table of Contents

Vulnerability summary

Product: Easy Digital Downloads
Plugin slug: easy-digital-downloads
Affected versions: All versions through 3.7.2
Fixed version: 3.7.3
Attack class: Improper authentication / authentication bypass
Required privilege: None
Impact: Existing WordPress account takeover, including administrator accounts
CVSS: 8.1 High according to Wordfence Intelligence
CVE: No CVE has been assigned as of publication
Wordfence identifier: WORDFENCE-f4250328-6d6c-4eb1-9ef2-334774c1d337
Disclosure date: October 30, 2026

Exploit path and prerequisites

The vulnerable flow occurs when a store accepts a PayPal guest checkout. During PayPal order capture, an email address supplied through the guest-checkout process can be trusted as proof of identity. If that address belongs to an existing WordPress user, insufficient account verification can bind the checkout flow to that user and result in account takeover.

The attacker does not need a pre-existing account. Practical exposure requires Easy Digital Downloads 3.7.2 or earlier and the affected PayPal guest-checkout path. The highest impact occurs when the targeted email belongs to an administrator or another privileged WordPress user. This advisory is not evidence that every Easy Digital Downloads store has been compromised, and no public active-exploitation confirmation was identified during this review.

Patch and immediate mitigation

Update Easy Digital Downloads to version 3.7.3 or later immediately.
Confirm the deployed files and database report the fixed version after the update.
If an immediate update is impossible, temporarily disable PayPal guest checkout or the PayPal gateway until the patched plugin can be deployed.
Review privileged WordPress accounts, Easy Digital Downloads customers and recent PayPal orders for unexpected identity associations.
Invalidate active sessions and rotate credentials for any account with suspicious login activity. Revoke unfamiliar application passwords and remove unauthorized administrators.

Verify the installed version

wp plugin get easy-digital-downloads --fields=name,status,version,update
wp plugin update easy-digital-downloads
wp plugin get easy-digital-downloads --field=version

The final version must be 3.7.3 or newer. Easy Digital Downloads currently requires WordPress 6.7 or later and PHP 8.0 or later, so test compatibility on older production stacks before deployment while keeping the affected payment path disabled.

Account and order investigation

Start by recording all current privileged users. Easy Digital Downloads 3.7.3 also adds the customer’s last login date and IP address to the customer screen and personal data export, which can assist an investigation after upgrading.

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table
wp user list --role=shop_manager --fields=ID,user_login,user_email,user_registered --format=table
wp user session list <user-id>

For each administrator email, review Easy Digital Downloads customer records and PayPal orders completed during the exposure window. Look for guest orders unexpectedly associated with a privileged account, login IPs that do not match normal administrator activity, profile changes, new application passwords, recently created administrators, and security-setting changes. Correlate findings with web-server, WordPress security and PayPal logs. Preserve logs and order records before making cleanup changes.

Post-remediation verification

Confirm the plugin reports version 3.7.3 or later.
Test a normal PayPal guest purchase in staging and verify it does not authenticate as an existing WordPress user.
Confirm no unexpected administrator accounts or active sessions remain.
Check PayPal webhook and order-processing logs for unexplained captures, retries or identity mismatches.
Run WordPress core and plugin integrity checks and inspect recently modified plugin, theme and must-use plugin files.

Easy Digital Downloads through 3.7.2 – Unauthenticated Administrator Account Takeover