Easy Digital Downloads Cross-Site Request Forgery Vulnerability in Square Integration

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Easy Digital Downloads (EDD) plugin for WordPress, affecting all versions through 3.6.7. The issue arises from the 'handle_oauth_redirect()' function, which processes Square OAuth tokens from a user-supplied GET parameter without proper nonce verification. This lack of validation allows unauthenticated attackers to manipulate the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a malicious link, potentially leading to unauthorized access to the payment account.

Impact

Exploitation of this vulnerability could result in unauthorized modification of Square payment gateway credentials, allowing for payment account hijacking.

Reproduction

To reproduce this vulnerability, an attacker must craft a link that, when clicked by a logged-in administrator, sends a request to the WordPress site with a 'square_tokens' parameter containing the OAuth tokens. The request will bypass CSRF protections, allowing the attacker to overwrite the Square payment gateway credentials.

Remediation

Users are advised to update the Easy Digital Downloads plugin to version 3.6.8 or later.