Easy Digital Downloads CVE-2026-120538

Exploitation requires that the EDD PayPal gateway be configured and usable, and that the attacker drive a PayPal purchase flow to completion - either the PayPal guest checkout, the standard PayPal checkout, or the REST UnbrandedCard and Fastlane flows, all of which reach the vulnerable PurchaseUser::maybe_log_in_after_capture() sink. The specific prerequisite is that the attacker enters a targeted WordPress administrator's email address in the guest-checkout field AND that administrator has NO existing EDD customer record, which is what allows edd_get_purchase_form_user() to rebind the order's user_id to that admin. Limiting factors: the attack succeeds only against admins lacking an EDD customer record, and the attacker must actually complete a PayPal payment capture; per the CVSS vector (PR:N/UI:N) no authentication or victim interaction is required.

This is a genuinely high-impact authentication flaw whose real-world risk is moderated by one meaningful precondition. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) correctly captures that the attack is remote and unauthenticated (PR:N, so an unauthenticated attacker per the vector) with full confidentiality, integrity and availability impact - consistent with a complete administrator account takeover. The AC:H rating aligns with the description's stated constraint: the targeted administrator must have NO existing EDD customer record for the email-binding step to rebind the order's user_id, a condition outside the attacker's control. No CISA KEV listing is present and no EPSS score was supplied, so there is no signal of active or probabilistically likely exploitation; the references are the Wordfence advisory and plugins.trac source lines, not a verified exploit. The vuln.today decision label is 'this_week' (not act_now/emergency), which matches a serious-but-not-actively-exploited posture. Net: treat as a real priority to patch promptly given the admin-takeover impact and unauthenticated network vector, but it is not an in-progress emergency - the AC:H precondition and the need to complete a real PayPal payment flow reduce the likelihood of trivial mass exploitation. EPSS and PoC-availability data are absent and should be verified before final prioritization.

An unauthenticated attacker begins a PayPal guest checkout on an EDD-powered store and enters a site administrator's email address in the guest-checkout field, where that administrator has no existing EDD customer record. The attacker completes the PayPal purchase; the capture sink then issues an authenticated session cookie bound to the administrator's account, yielding full admin access. The AC:H network vector means no authentication or user interaction is needed, but the attacker must fund and complete a genuine PayPal transaction and the target admin must lack an EDD customer record; no public exploit code is referenced in the available data.