PatchSiren cyber security CVE debrief
CVE-2026-7533 smub CVE debrief
A Cross-Site Request Forgery (CSRF) vulnerability in the Easy Digital Downloads WordPress plugin allows unauthenticated attackers to overwrite Square payment gateway credentials by tricking a logged-in administrator into visiting a malicious link. The flaw exists in the `handle_oauth_redirect()` function, which processes OAuth tokens from user-supplied GET parameters without nonce verification. This could enable payment account hijacking.
- Vendor
- smub
- Product
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-28
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-28
Who should care
WordPress site administrators using Easy Digital Downloads with Square payment processing; e-commerce security teams; payment compliance auditors
Technical summary
The Easy Digital Downloads plugin for WordPress contains a CSRF vulnerability in its Square payment gateway integration. The `handle_oauth_redirect()` function, hooked to `admin_init`, accepts OAuth tokens from GET parameters without validating a nonce token. An unauthenticated attacker can craft a malicious URL containing attacker-controlled Square OAuth credentials. When a logged-in administrator clicks this link, the plugin saves the attacker's credentials as the store's Square payment gateway configuration, redirecting payments to the attacker-controlled account. The vulnerability requires user interaction (administrator clicking a link) but no authentication bypass, as the `admin_init` hook executes for authenticated admin sessions.
Defensive priority
medium
Recommended defensive actions
- Upgrade Easy Digital Downloads to version 3.6.8 or later
- Implement additional admin-level access controls for payment gateway configuration changes
- Consider Web Application Firewall rules to detect suspicious OAuth redirect patterns
- Review Square payment gateway settings for unauthorized modifications if running affected versions
Evidence notes
The vulnerability was reported to Wordfence and affects all versions up to and including 3.6.7. Source code references confirm the `handle_oauth_redirect()` function is registered on `admin_init` and lacks CSRF token validation when processing Square OAuth tokens from GET parameters. A changeset reference indicates a patch was committed to the plugin repository.
Official resources
2026-05-28