The vulnerability allows an attacker to acquire an authenticated session as a WordPress administrator by exploiting the Easy Digital Downloads PayPal guest‑checkout flow. During guest checkout the email entered is trusted as an identity, and the plugin associates the new order with an existing WordPress user matching that email. The PayPal capture logic then logs the user in automatically, creating a session cookie. An unauthenticated attacker can therefore use an administrator’s email address—without requiring an existing EDD customer record—to gain full administrator control.

Easy Digital Downloads plugin for WordPress, any version up to and including 3.7.2. All installations that enable PayPal guest checkout are susceptible.

The CVSS score of 8.1 indicates high severity, and the EPSS score is not available, meaning the actual exploitation probability is uncertain. The vulnerability is not listed in CISA's KEV catalog. Attackers likely exploit the bug remotely via the publicly accessible PayPal checkout pages. A successful exploit would compromise confidentiality, integrity, and availability of the WordPress site by granting an attacker administrator privileges.