CVE-2026-4140: CSRF in Ni WooCommerce Order Export

An attacker exploiting this CSRF vulnerability can modify the Ni WooCommerce Order Export plugin's settings without authentication. This could lead to unauthorized data exports, altered export configurations, or even the injection of malicious code if the plugin settings control export behavior. The potential impact extends to sensitive customer data contained within WooCommerce orders, as the attacker could manipulate export destinations or filtering criteria. Successful exploitation could compromise the integrity and confidentiality of order data, potentially leading to data breaches and regulatory compliance issues. While the plugin itself doesn't directly handle sensitive data, its configuration controls how that data is processed and exported.

1. Reserved2026-03-13
2. Published2026-04-21
3. Modified2026-04-22
4. EPSS updated2026-04-29

The primary mitigation for CVE-2026-4140 is to upgrade the Ni WooCommerce Order Export plugin to a version that includes the necessary nonce validation fixes. If immediate upgrading is not possible due to compatibility concerns or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests to the niorderexportaction() AJAX handler that lack a valid CSRF token. Additionally, restrict access to the plugin's settings page using WordPress's role-based access control features to limit who can modify the configuration. After upgrading, confirm the fix by attempting a CSRF attack against the niorderexportaction() endpoint using a forged request and verifying that the request is rejected due to nonce validation.

Active installs

20

Plugin rating