Beveiligingsadvies

CVE-2026-7533

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-05-28 05:30:41

Laatst bijgewerkt 2026-05-28 10:36:05

Toegewezen door Wordfence

CVSS-score 4.3

Status PUBLISHED

Beschrijving

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the `handle_oauth_redirect()` function, which is registered on the `admin_init` hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.

← Alle CVE's bekijken Bekijk op cve.org ↗