CVE-2026-7533
Received Received - Intake
Cross-Site Request Forgery in Easy Digital Downloads Plugin

Publication date: 2026-05-28

Last updated on: 2026-05-28

Assigner: Wordfence

Description
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the `handle_oauth_redirect()` function, which is registered on the `admin_init` hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-05-28
Generated
2026-06-17
AI Q&A
2026-05-28
EPSS Evaluated
2026-06-16
NVD
CVE-2026-7533
EUVD
EUVD-2026-32725
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
easy_digital_downloads easy_digital_downloads to 3.6.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Easy Digital Downloads plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 3.6.7. This occurs because the function handle_oauth_redirect(), which processes Square OAuth tokens from user-supplied GET parameters, does not verify a CSRF token (nonce). This function is triggered on the admin_init hook, allowing an attacker to trick a logged-in administrator into clicking a malicious link that can overwrite the store's Square payment gateway credentials.

Impact Analysis

This vulnerability can allow unauthenticated attackers to hijack the store's payment account by overwriting the Square payment gateway credentials. This happens when an administrator is tricked into clicking a crafted link, potentially leading to unauthorized control over payment processing and financial transactions.

Compliance Impact

The vulnerability allows unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.

Such unauthorized access and manipulation of payment credentials could lead to violations of data protection and security requirements under common standards and regulations like GDPR and HIPAA, which mandate safeguarding sensitive payment and personal data against unauthorized access and modification.

However, the provided information does not explicitly detail the direct impact on compliance with these regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7533. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart