CVE-2026-7533
Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the `handle_oauth_redirect()` function, which is registered on the `admin_init` hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.
| CWE | CWE-352 |
| Vendor | smub |
| Product | easy digital downloads – ecommerce payments and subscriptions made easy |
| Published | May 28, 2026 |
| Last Updated | May 28, 2026 |
Get instant alerts for smub easy digital downloads – ecommerce payments and subscriptions made easy
Be the first to know when new medium vulnerabilities affecting smub easy digital downloads – ecommerce payments and subscriptions made easy are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N