PT-2026-34297 · WordPress · Ni Woocommerce Order Export

Muhammad Afnaan · Published 2026-04-22 · Updated 2026-05-01 · CVE-2026-4140

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ni WooCommerce Order Export versions prior to 3.1.7

Description An issue exists where missing nonce validation in the ni order export action() AJAX handler function allows unauthenticated attackers to modify plugin settings via a forged request. The handler processes settings updates when the 'page' parameter is set to 'nioe-order-settings', delegating to Ni Order Setting::page ajax() which calls update option('ni order export option', $ REQUEST) without verifying a nonce or checking user capabilities. This can be exploited if a site administrator is tricked into performing an action, such as clicking a link.

Recommendations Update to a version later than 3.1.6.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4140

Affected Products

Ni Woocommerce Order Export

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-4140 · Security Note
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post
• https://plugins.trac.wordpress.org/browser/ni-woocommerce-order-export/tags/3.1.6/include/ni-order-export.php#L136 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2d62c49c-3a33-4865-abcc-22d8e38ac198?source=cve · Note
• https://twitter.com/CVEnew/status/2047428132756713906 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ni-woocommerce-order-export/tags/3.1.6/include/ni-order-setting.php#L59 · Note
• https://plugins.trac.wordpress.org/browser/ni-woocommerce-order-export/trunk/include/ni-order-export.php#L136 · Note
• https://twitter.com/VulmonFeeds/status/2046932829393523041 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ni-woocommerce-order-export/trunk/include/ni-order-setting.php#L59 · Note