CVE-2026-7533: Easy Digital Downloads CSRF Vulnerability

CVE-2026-7533 Overview

CVE-2026-7533 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Easy Digital Downloads plugin for WordPress in all versions up to and including 3.6.7. The flaw resides in the handle_oauth_redirect() function, which is hooked into admin_init and processes Square OAuth tokens from a user-supplied GET parameter without validating a CSRF nonce. An unauthenticated attacker can craft a malicious link that, when clicked by a logged-in administrator, overwrites the store's Square payment gateway credentials. Successful exploitation can result in hijacking of the merchant's Square payment account and redirection of customer payments.

Critical Impact
Attackers can hijack the Square payment gateway connection of any vulnerable WordPress store by tricking an administrator into clicking a crafted link, potentially diverting payment flows to attacker-controlled Square accounts.

Affected Products

Easy Digital Downloads plugin for WordPress, all versions up to and including 3.6.7
WordPress sites using the Square payment gateway integration provided by Easy Digital Downloads
Affected source files: src/Gateways/Square/Connection.php and src/Gateways/Square/Gateway.php

Discovery Timeline

2026-05-28 - CVE-2026-7533 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-7533

Vulnerability Analysis

The vulnerability stems from missing nonce verification in the handle_oauth_redirect() function of the Easy Digital Downloads Square gateway integration. The function is registered on the admin_init hook, meaning it executes on every WordPress administrative page load. It accepts Square OAuth tokens directly from GET parameters supplied by the user agent. Because no CSRF nonce or referrer check guards the handler, any request reaching /wp-admin/ with the expected query parameters triggers credential overwrite logic.

This is a classic CSRF pattern in WordPress plugin development. WordPress provides wp_verify_nonce() and check_admin_referer() for state-changing administrative actions, but neither is invoked in the vulnerable code paths in Connection.php and Gateway.php. The impact is integrity loss on payment gateway configuration without confidentiality or availability impact, which aligns with the integrity-only CVSS scope.

Root Cause

The root cause is the absence of CSRF token validation [CWE-352] in an administrative state-changing handler. The Square OAuth redirect endpoint trusts that any authenticated administrator request was intentionally initiated by that administrator. Because the handler reads OAuth tokens from query string parameters and persists them as the store's live Square credentials, an attacker who can cause the admin browser to issue a GET request can replace those credentials.

Attack Vector

Exploitation requires user interaction from a logged-in WordPress administrator. The attacker first obtains attacker-controlled Square OAuth tokens, then crafts a URL targeting the victim store's admin_init Square OAuth redirect handler with those tokens embedded in the query string. Delivery occurs through phishing email, a malicious advertisement, a comment containing a link, or any web page the administrator visits while authenticated. When the administrator's browser issues the request, the plugin overwrites the legitimate Square credentials with the attacker's, routing subsequent customer payments to the attacker-controlled Square merchant account.

No authentication is required from the attacker, and no special privileges are needed beyond convincing an administrator to click a link. See the Wordfence Vulnerability Analysis and the WordPress Code Changeset for the patched code paths.

Detection Methods for CVE-2026-7533

Indicators of Compromise

Unexpected entries in WordPress admin access logs containing Square OAuth callback parameters originating from external referrers such as email clients or unrelated domains.
Sudden changes to the Square gateway configuration in Easy Digital Downloads settings, including unfamiliar merchant IDs, location IDs, or refreshed OAuth tokens.
Customer-reported payment failures or payments appearing in an unfamiliar Square merchant dashboard while the store reports successful transactions.
Administrator session activity immediately preceded by clicks on external links followed by admin_init requests carrying OAuth query parameters.

Detection Strategies

Inspect web server access logs for GET requests to /wp-admin/ containing Square OAuth-related parameters with a Referer header pointing to non-trusted origins.
Audit the WordPress wp_options table for unexpected modifications to Easy Digital Downloads Square gateway option rows and compare timestamps against admin login events.
Review installed plugin versions across the estate and flag any Easy Digital Downloads installation at version 3.6.7 or earlier.
Correlate Square dashboard audit logs with WordPress administrative events to detect credential rotations not initiated by store operators.

Monitoring Recommendations

Enable WordPress audit logging plugins to capture changes to payment gateway settings and administrator-triggered option updates.
Monitor outbound requests from WordPress admin sessions to Square OAuth endpoints and alert on unusual flows.
Track plugin version drift across managed WordPress sites and alert when any site runs Easy Digital Downloads at or below version 3.6.7.

How to Mitigate CVE-2026-7533

Immediate Actions Required

Update the Easy Digital Downloads plugin to a version newer than 3.6.7 that includes the nonce verification fix referenced in the WordPress Code Changeset.
Verify the currently configured Square merchant account, location ID, and OAuth tokens match the legitimate merchant identity, and re-authenticate the Square connection if any discrepancy is found.
Rotate Square OAuth credentials and revoke any unrecognized authorized applications from the Square account dashboard.
Require administrators to log out of WordPress before browsing untrusted sites until the patch is applied.

Patch Information

The fix is shipped in the Easy Digital Downloads release following version 3.6.7. The patch adds nonce verification to the handle_oauth_redirect() function so that OAuth callback processing only proceeds when a valid WordPress nonce accompanies the request. Review the corrected handler logic in the trunk Connection.php source and the trunk Gateway.php source.

Workarounds

Temporarily disconnect the Square payment gateway in Easy Digital Downloads settings until the plugin can be updated.
Restrict WordPress administrator access using IP allowlisting on /wp-admin/ through web server or WAF rules.
Deploy a WAF rule that blocks GET requests to /wp-admin/ containing Square OAuth callback parameters when the Referer header is missing or external.
Enforce least privilege by reducing the number of accounts with the manage_options capability while the patch is rolled out.

bash

# Example WAF rule (ModSecurity) to block external referer Square OAuth callbacks to wp-admin
SecRule REQUEST_URI "@contains /wp-admin/" \
  "chain,phase:1,deny,status:403,id:1027533,msg:'Block CSRF on EDD Square OAuth handler (CVE-2026-7533)'"
  SecRule ARGS_NAMES "@rx (?i)(code|state|square)" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-store.example.com/"