PT-2026-34297 · Anzia · Ni Woocommerce Order Export

Muhammad Afnaan

·

Published

2026-04-22

·

Updated

2026-04-22

·

CVE-2026-4140

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
The Ni WooCommerce Order Export plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.6. This is due to missing nonce validation in the ni order export action() AJAX handler function. The handler processes settings updates when the 'page' parameter is set to 'nioe-order-settings', delegating to Ni Order Setting::page ajax() which calls update option('ni order export option', $ REQUEST) without verifying any nonce or checking user capabilities. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4140

Affected Products

Ni Woocommerce Order Export