Executive Summary

The Ni WooCommerce Order Export plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 3.1.6. This occurs because the plugin's AJAX handler function ni_order_export_action() does not validate a security nonce or check user capabilities before processing settings updates. Specifically, when the 'page' parameter is set to 'nioe-order-settings', the handler calls update_option('ni_order_export_option', $_REQUEST) without verifying the request's authenticity. This allows an attacker to trick a site administrator into performing an unwanted action, such as clicking a malicious link, which then modifies the plugin's settings without proper authorization.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the Ni WooCommerce Order Export plugin to a version later than 3.1.6 where the nonce validation issue is fixed.

If an update is not immediately available, restrict access to the AJAX handler by limiting permissions or disabling the plugin temporarily to prevent unauthorized settings modification.

Additionally, educate site administrators to avoid clicking on suspicious links that could trigger forged requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unauthenticated attacker to modify the settings of the Ni WooCommerce Order Export plugin by tricking an administrator into clicking a malicious link. Although the attacker cannot directly execute commands or access data, they can change plugin configurations, potentially disrupting normal operations or causing unintended behavior in the plugin.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the Ni WooCommerce Order Export plugin vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0