EUVD-2026-24682
GHSA-p2vp-x377-3m3c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Ni WooCommerce Order Export plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.6. This is due to missing nonce validation in the ni_order_export_action() AJAX handler function. The handler processes settings updates when the 'page' parameter is set to 'nioe-order-settings', delegating to Ni_Order_Setting::page_ajax() which calls update_option('ni_order_export_option', $_REQUEST) without verifying any nonce or checking user capabilities. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
AnalysisAI
Cross-Site Request Forgery in Ni WooCommerce Order Export plugin for WordPress allows unauthenticated attackers to modify plugin settings by tricking an administrator into clicking a malicious link, due to missing nonce validation in the AJAX settings handler. Affected versions through 3.1.6 accept direct $_REQUEST input to update_option() without any CSRF protection or capability checks, enabling unauthorized configuration changes.
Technical ContextAI
The vulnerability exists in the ni_order_export_action() AJAX handler function which processes requests when the 'page' parameter equals 'nioe-order-settings'. This handler delegates to the Ni_Order_Setting::page_ajax() method, which directly calls update_option('ni_order_export_option', $_REQUEST) without invoking WordPress nonce verification functions (wp_verify_nonce) or checking administrative capabilities (current_user_can). The flaw is classified as CWE-352 (Cross-Site Request Forgery), a classic web vulnerability where state-changing operations lack proper origin validation. WordPress AJAX handlers registered via add_action('wp_ajax_...') are accessible to authenticated users by default, but in this case the missing capability checks allow any authenticated request-including those forged from external sites by manipulating admin users. The $_REQUEST superglobal captures both POST and GET parameters, increasing the attack surface.
RemediationAI
Update Ni WooCommerce Order Export to the latest version available from the WordPress plugin repository (check the plugin's update mechanism or manually visit plugins.trac.wordpress.org for the current patched version). If a patched version is available, deactivate the current plugin, download the update, and reactivate. For sites unable to update immediately, implement WordPress user role restrictions using a capability management plugin to limit AJAX access to trusted administrators only, though this is a temporary measure and not a substitute for the vendor patch. Additionally, enforce strict Cookie SameSite policies at the web server level (Apache/Nginx configuration or .htaccess: 'Set-Cookie: ... SameSite=Strict') to prevent cross-site cookie transmission, which reduces CSRF attack surface for all WordPress plugins. Monitor plugin repository announcements and Wordfence threat alerts for patch release details. Do NOT disable the plugin entirely unless it is non-critical, as that impacts legitimate order export functionality.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today