CVE-2026-7533: Easy Digital Downloads CSRF Vulnerability Allows Payment Account Hijacking

Technical summary

CVE-2026-7533 is a Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads versions up to 3.6.7. The `handle_oauth_redirect()` function, hooked into `admin_init`, processes Square OAuth tokens from GET parameters without validating a nonce token. An unauthenticated attacker crafts a URL containing a malicious OAuth code and tricks an authenticated administrator into visiting it (e.g., via phishing email or forum post). When the admin's browser makes the request, the plugin accepts it as valid, overwrites the stored Square credentials, and the attacker gains control of the payment flow.

Business impact

A compromised Square integration directly threatens payment processing integrity and customer trust. Attackers can redirect transaction proceeds to external accounts, potentially for extended periods before detection. This creates immediate financial loss, customer payment data exposure risk, and significant operational disruption while the legitimate store owner regains access. Reputational damage and potential PCI compliance violations compound the impact. The attack requires only social engineering of a single administrator, making it a practical threat even for security-conscious organizations.

Affected systems

Easy Digital Downloads plugin for WordPress, all versions up to and including 3.6.7. Any WordPress site running this plugin with the Square payment gateway configured is vulnerable if administrators are active on the site and could be targeted via phishing or malicious links.

Exploitability

Exploitability is moderate but practical. The attack requires tricking an authenticated administrator to click a malicious link—a social engineering task, but one that succeeds reliably against busy users. No special access, authentication, or complex technical steps are needed on the attacker's side. The CVSS score of 4.3 (Medium) reflects the requirement for user interaction (the administrator must click the link) and the fact that the attack does not directly exfiltrate data or cause service availability loss. However, the *consequence* of account hijacking is severe, so the practical risk exceeds the numerical score.

Remediation

Update Easy Digital Downloads to a patched version that includes nonce verification in the `handle_oauth_redirect()` function. Verify the patch version against the official Easy Digital Downloads security advisory. Additionally, audit current Square OAuth credentials and recent payment transactions to detect unauthorized changes. Implement IP allowlisting or secondary authentication for payment gateway configuration changes where possible.

Patch guidance

Administrators should check the Easy Digital Downloads official plugin page and security advisories for the specific version that addresses this CSRF flaw. Apply the update immediately after verifying it addresses CVE-2026-7533. Review release notes to confirm nonce verification was added to the OAuth redirect handler. Test Square payment processing in a staging environment before deploying to production.

Detection guidance

Monitor for suspicious admin requests via access logs, focusing on requests to `admin_init` or payment gateway configuration endpoints with unusual GET parameters, especially those containing OAuth tokens from unexpected sources. Audit WordPress user activity logs for unauthorized changes to Square payment credentials. Check for recent changes to the `wp_options` table where payment gateway settings are stored (look for timestamps outside normal maintenance windows). Security plugins with CSRF monitoring may alert on exploitation attempts.

Why prioritize this

Although the CVSS score is Medium (4.3), the practical risk is elevated because the vulnerability allows an attacker to hijack payment processing without technical sophistication. Any Easy Digital Downloads site accepting payments via Square should prioritize this patch. The attack surface is broad—any administrator on the site is a potential target—and the financial impact is direct and immediate. This should be treated as high-priority despite the moderate numerical severity rating.

Risk score, explained

The CVSS:3.1 score of 4.3 reflects low attack complexity (requires only a crafted link), no authentication needed from the attacker side, and the requirement for user interaction (a click). Impact is limited in scope to integrity of the payment configuration (CVSS rates this as 'Low' for indirect confidentiality/availability effects), but the *real-world consequence*—account hijacking leading to payment diversion—justifies urgent patching despite the score.

Frequently asked questions