CVE-2026-7533

The Easy Digital Downloads plugin for WordPress has a security flaw that allows malicious links to be clicked by an administrator, which can lead to unauthorized changes being made to the store's Square payment settings. This issue arises from the fact that the `handle_oauth_redirect()` function does not verify nonce values when processing GET parameters containing Square OAuth tokens. As a result, attackers can potentially hijack the store's payment accounts by exploiting this vulnerability in versions of the plugin up to and including 3.6.7.

Based on public CVE data (MITRE/NVD).