Easy Digital Downloads, one of the older WordPress e-commerce plugins, shipped a fix on 3 November 2026 for a flaw that lets an unauthenticated visitor end up logged in as a site administrator. The mechanism is a checkout flow that trusts an email address as proof of identity.
What happened
Tracked as CVE-2026-120538 and rated 8.1, the flaw lives in the PayPal guest checkout path in versions up to and including 3.7.2. When a guest order is created, the plugin matches the email address typed into the checkout form against existing WordPress users and rewrites the order to belong to that user.
A second function then handles the PayPal capture. It looks the user up by the order's email address, sees that the order's user ID matches, and issues an authenticated session cookie. An attacker who starts a guest checkout using an administrator's email address and completes a PayPal payment therefore finishes the flow holding that administrator's session.
The same path is reachable through the standard PayPal checkout and the REST card and Fastlane flows. The fix shipped in 3.7.3; Patchstack has flagged the issue as high priority and expects mass exploitation attempts against unpatched stores.
Who is affected
- WordPress sites running Easy Digital Downloads 3.7.2 or earlier with a PayPal gateway enabled.
- Stores where an administrator account has no existing EDD customer record under that email address, which is the normal state on a shop that has never sold to its own admin.
- Sites that accept guest checkout, which is EDD's default behaviour for digital sales.
What to do now
Update Easy Digital Downloads to 3.7.3 now, then check your administrator list for accounts you did not create.
- Update the plugin to 3.7.3 or later on every site, including staging and multisite installs.
- Review wp_users and recent order records for new administrator accounts and for guest orders carrying a staff email address.
- If the plugin cannot be updated immediately, disable the PayPal gateway or put the store into maintenance mode rather than leaving guest checkout live.
- Reset passwords and revoke sessions for administrator accounts on any site that ran a vulnerable version with PayPal enabled, since a successful exploitation leaves no obvious trace in the order list.
What this means for South African businesses
Digital-product and course stores are a common small-business pattern here, and EDD is often installed once and then left alone through years of theme and PHP upgrades. The precondition for exploitation is narrow on paper but common in practice, because most small shops have never tested whether their own admin email has a customer record. I would treat any unpatched EDD store with PayPal enabled as already compromised rather than merely at risk, and check the user table before assuming otherwise.
Source: Wordfence Intelligence advisory for CVE-2026-120538.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.