CVE-2026-7533

Vulnerability

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 3.6.7. The issue exists in the handle_oauth_redirect() function located in src/Gateways/Square/Connection.php [1][2][3][4]. This function processes Square OAuth tokens from a user-supplied GET parameter (square_tokens) without any nonce or CSRF token validation, making it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials.

Exploitation

An attacker can craft a malicious link or webpage that triggers the handle_oauth_redirect() function with a crafted square_tokens parameter. The attacker must trick a logged-in administrator into clicking the crafted link while they are authenticated in the WordPress admin area. No other authentication or user interaction is required beyond the click. The attacker does not need any special privileges.

Impact

Upon successful exploitation, the attacker can overwrite the store's Square payment gateway credentials, including access tokens, refresh tokens, and client ID. This effectively hijacks the payment account, allowing the attacker to receive payments intended for the store, view transaction data, or perform other actions on the Square account. The compromise results in a direct financial and data integrity impact.

Mitigation

The vendor has released a patched version; users should update to version 3.6.8 or later. For users unable to update immediately, a workaround is to restrict access to the Square integration settings and ensure administrators are aware of CSRF risks. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of publication.