CVE-2026-4140
CSRF Vulnerability in Ni WooCommerce Order Export Plugin Allows Settings Modification
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ni | woocommerce_order_export | to 3.1.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Ni WooCommerce Order Export plugin to a version later than 3.1.6 where the nonce validation issue is fixed.
If an update is not immediately available, restrict access to the AJAX handler by limiting permissions or disabling the plugin temporarily to prevent unauthorized settings modification.
Additionally, educate site administrators to avoid clicking on suspicious links that could trigger forged requests.
Can you explain this vulnerability to me?
The Ni WooCommerce Order Export plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 3.1.6. This occurs because the plugin's AJAX handler function ni_order_export_action() does not validate a security nonce or check user capabilities before processing settings updates. Specifically, when the 'page' parameter is set to 'nioe-order-settings', the handler calls update_option('ni_order_export_option', $_REQUEST) without verifying the request's authenticity. This allows an attacker to trick a site administrator into performing an unwanted action, such as clicking a malicious link, which then modifies the plugin's settings without proper authorization.
How can this vulnerability impact me? :
This vulnerability can allow an unauthenticated attacker to modify the settings of the Ni WooCommerce Order Export plugin by tricking an administrator into clicking a malicious link. Although the attacker cannot directly execute commands or access data, they can change plugin configurations, potentially disrupting normal operations or causing unintended behavior in the plugin.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the Ni WooCommerce Order Export plugin vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.