CVE-2026-7533

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the `handle_oauth_redirect()` function, which is registered on the `admin_init` hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.

• CWE-352

• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.5/src/Gateways/Square/Connection.php#L47
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.5/src/Gateways/Square/Connection.php#L58
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.6.5/src/Gateways/Square/Gateway.php#L114
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/src/Gateways/Square/Connection.php#L47
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/src/Gateways/Square/Connection.php#L58
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/src/Gateways/Square/Gateway.php#L114
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3536197%40easy-digital-downloads&old=3511193%40easy-digital-downloads&sfp_email=&sfph_mail=#file6607
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e375f761-459c-4cad-823b-2a94ac901410?source=cve

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7525The My Calendar – Accessible Event Manager plugin for WordPr…4.3
• CVE-2026-7526The PDF Embedder plugin for WordPress is vulnerable to Sensi…4.3
• CVE-2026-7528IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of…7.5
• CVE-2026-7529The wiseCampaign – WooCommerce Conversions Made Easy plugin …7.5
• CVE-2026-7531Use-after-free in PQC hybrid key-share handling. This is an …9.8
• CVE-2026-7532iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME i…7.5
• CVE-2026-7534The SUMO Reward Points plugin for WordPress is vulnerable to…7.2
• CVE-2026-7535A vulnerability was found in Open5GS up to 2.7.7. This affec…4.3
• CVE-2026-7536A vulnerability was determined in Open5GS up to 2.7.7. This …5.5
• CVE-2026-7537The MDJM Event Management plugin for WordPress is vulnerable…7.2
• CVE-2026-7538A vulnerability was identified in Totolink A8000RU 7.1cu.643…9.8
• CVE-2026-7539A potential security vulnerability has been identified in th…7.3