CVE-2026-120538 | CVSS: 8.1 | 严重级别: HIGH
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order
参考链接:
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/inc
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/inc
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/inc
📌 数据来源: NVD 官方