Junglewise Threat Intelligence

CVE-2026-7533: Easy Digital Downloads CSRF in Square Gateway Connection

CVE-2026-7533 · Severity: medium · CVSS 4.3 · Published 2026-05-28

Technologies: Easy Digital Downloads. Vendors: Easy Digital Downloads.

Executive brief

The Easy Digital Downloads plugin for WordPress, which manages e-commerce storefronts, contains a security flaw in its Square payment integration. An attacker could trick a site administrator into clicking a malicious link, allowing the attacker to overwrite the store's payment credentials. This could lead to payment account hijacking, where customer payments are redirected to an account controlled by the attacker.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Easy Digital Downloads plugin due to missing nonce verification in the `handle_oauth_redirect()` function. This function is registered on the `admin_init` hook and processes Square OAuth tokens from user-supplied GET parameters without validating a CSRF token. An unauthenticated attacker can exploit this by tricking a logged-in administrator into interacting with a specially crafted link. Successful exploitation allows the attacker to overwrite the store's Square payment gateway credentials, potentially leading to payment hijacking.

Affected products

  • Easy Digital Downloads Easy Digital Downloads up to, and including, 3.6.7

Timeline

  • 2026-05-28: disclosed: Initial publication of the CVE record.

References

Related threats