Aller au contenu
en Se connecter
4.3 Moyenne

CVE-2026-7533 The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and…

Description

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the `handle_oauth_redirect()` function, which is registered on the `admin_init` hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.

Produits et versions touchés

Produit Versions touchées Corrigé en
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy 3.6 premières → 3.6.7 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

Les 17 CVE de Easy Digital Downloads – eCommerce Payments and Subscriptions made easy →
CVE-2026-120538 The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator… 8.1 Élevée CVE-2026-14335 The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored… 7.2 Élevée CVE-2026-12476 The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including… 7.2 Élevée CVE-2025-14783 The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and… 4.3 Moyenne
Suivre cette CVE