CVE-2026-7533: Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter

Vulnerability summary

CVE-2026-7533 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability in smub easy digital downloads – ecommerce payments and subscriptions made easy. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.4% of scored vulnerabilities. Fixed in 3.6.8.

Timeline

1. 28-05-2026
   PublishedVulnerability first disclosed.
2. 28-05-2026
   Last modifiedVulnerability information updated.

Description

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the `handle_oauth_redirect()` function, which is registered on the `admin_init` hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.