The Easy Digital Downloads plugin for WordPress contains a flaw in the handle_oauth_redirect() function. A nonce check is omitted, allowing an attacker to send a crafted request with a square_tokens parameter that the server processes as if it came from an authenticated administrator. This missing CSRF protection means an unauthenticated attacker can trick a logged‑in admin into clicking a link that overwrites the store’s Square payment gateway credentials, potentially leading to hijacked payment accounts.

All installations of the Easy Digital Downloads plugin version 3.6.7 and earlier are vulnerable. The product is the Easy Digital Downloads eCommerce Payments and Subscriptions plugin for WordPress. No specific sub‑versions or extensions are listed separately.

The CVSS score of 4.3 indicates a medium severity threat. The EPSS score is not available, but the lack of any exploit code in the public domain and the fact that it is not listed in CISA’s KEV catalog suggest a moderate likelihood of exploitation. Inferred attack vector: an attacker would craft a URL containing a square_tokens parameter and lure a logged‑in administrator to click it, thereby executing the CSRF attack without authentication.