The Easy Digital Downloads plugin for WordPress contains a CSRF vulnerability (CWE-352) in the handle_oauth_redirect() function registered on the admin_init hook. This function processes Square OAuth tokens from user-supplied GET parameters without nonce verification, enabling attackers to perform unauthorized actions by tricking administrators into clicking malicious links. The vulnerability affects all versions up to and including 3.6.7. Exploitation could allow overwriting of Square payment gateway credentials, risking payment account compromise. No patch or official remediation level has been published as of the data provided.

An attacker can exploit this vulnerability to overwrite the store's Square payment gateway credentials by leveraging CSRF against a logged-in administrator. This may lead to payment account hijacking, impacting the integrity of payment processing. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links while logged into WordPress with administrative privileges. Monitoring vendor channels for updates is recommended.