EUVD-2026-32725
GHSA-vq6x-6j8x-vr9j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the handle_oauth_redirect() function, which is registered on the admin_init hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.
AnalysisAI
Cross-Site Request Forgery in Easy Digital Downloads WordPress plugin through version 3.6.7 enables payment account hijacking by exploiting the Square gateway's unprotected OAuth callback. The handle_oauth_redirect() function, registered on the admin_init hook, accepts attacker-supplied Square OAuth tokens via GET parameters with no nonce validation, allowing any unauthenticated attacker to overwrite stored Square payment credentials by tricking a logged-in administrator into clicking a crafted link. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the financial impact potential - silent redirection of all payment processing to an attacker-controlled Square account - meaningfully exceeds what the CVSS score of 4.3 conveys.
Technical ContextAI
Easy Digital Downloads (EDD) is a widely-deployed WordPress e-commerce plugin. The vulnerability resides in its Square payment gateway integration, specifically within the handle_oauth_redirect() function in src/Gateways/Square/Connection.php (lines 47 and 58) and associated logic in src/Gateways/Square/Gateway.php. This function is registered as a callback on the WordPress admin_init action hook, meaning it fires on every admin-area page load. The function reads Square OAuth tokens directly from user-supplied HTTP GET parameters and writes them as stored gateway credentials without first verifying a WordPress nonce - the platform's standard CSRF mitigation mechanism. CWE-352 (Cross-Site Request Forgery) describes the root cause: the server fails to distinguish between requests deliberately initiated by the authenticated user and those forged by a third party, since browsers automatically attach session cookies to any matching request. The attack abuses the OAuth callback flow, which is designed for legitimate Square authorization, as an unauthenticated credential-injection vector.
RemediationAI
Update Easy Digital Downloads to a version beyond 3.6.7; the WordPress plugin trac changeset (revision 3536197 vs. 3511193) confirms an upstream fix has been committed to the repository, but the exact released patch version number is not independently confirmed from the available intelligence data - administrators should verify the current release in the WordPress plugin directory and confirm it post-dates this changeset. As a compensating control prior to patching, disable the Square payment gateway integration in EDD settings to prevent handle_oauth_redirect() from processing OAuth callbacks; note this will halt all Square-based payment processing and requires an alternative payment method. WordPress administrators should also consider restricting wp-admin access by IP allowlist to reduce the attack surface for social-engineering delivery, though this does not eliminate the underlying vulnerability. The Wordfence advisory is available at https://www.wordfence.com/threat-intel/vulnerabilities/id/e375f761-459c-4cad-823b-2a94ac901410.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today