What is the CVSS score of CVE-2026-4140?

CVE-2026-4140 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Ni WooCommerce Order Export CVE-2026-4140

EUVD-2026-24682 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-22 Wordfence

GHSA-p2vp-x377-3m3c

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:01 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24682

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The Ni WooCommerce Order Export plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.6. This is due to missing nonce validation in the ni_order_export_action() AJAX handler function. The handler processes settings updates when the 'page' parameter is set to 'nioe-order-settings', delegating to Ni_Order_Setting::page_ajax() which calls update_option('ni_order_export_option', $_REQUEST) without verifying any nonce or checking user capabilities. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

AnalysisAI

Cross-Site Request Forgery in Ni WooCommerce Order Export plugin for WordPress allows unauthenticated attackers to modify plugin settings by tricking an administrator into clicking a malicious link, due to missing nonce validation in the AJAX settings handler. Affected versions through 3.1.6 accept direct $_REQUEST input to update_option() without any CSRF protection or capability checks, enabling unauthorized configuration changes.

Technical ContextAI

The vulnerability exists in the ni_order_export_action() AJAX handler function which processes requests when the 'page' parameter equals 'nioe-order-settings'. This handler delegates to the Ni_Order_Setting::page_ajax() method, which directly calls update_option('ni_order_export_option', $_REQUEST) without invoking WordPress nonce verification functions (wp_verify_nonce) or checking administrative capabilities (current_user_can). The flaw is classified as CWE-352 (Cross-Site Request Forgery), a classic web vulnerability where state-changing operations lack proper origin validation. WordPress AJAX handlers registered via add_action('wp_ajax_...') are accessible to authenticated users by default, but in this case the missing capability checks allow any authenticated request-including those forged from external sites by manipulating admin users. The $_REQUEST superglobal captures both POST and GET parameters, increasing the attack surface.

RemediationAI

Update Ni WooCommerce Order Export to the latest version available from the WordPress plugin repository (check the plugin's update mechanism or manually visit plugins.trac.wordpress.org for the current patched version). If a patched version is available, deactivate the current plugin, download the update, and reactivate. For sites unable to update immediately, implement WordPress user role restrictions using a capability management plugin to limit AJAX access to trusted administrators only, though this is a temporary measure and not a substitute for the vendor patch. Additionally, enforce strict Cookie SameSite policies at the web server level (Apache/Nginx configuration or .htaccess: 'Set-Cookie: ... SameSite=Strict') to prevent cross-site cookie transmission, which reduces CSRF attack surface for all WordPress plugins. Monitor plugin repository announcements and Wordfence threat alerts for patch release details. Do NOT disable the plugin entirely unless it is non-critical, as that impacts legitimate order export functionality.