CVE-2026-78474
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Ni WooCommerce Sales Report plugin before 4.2.0 lacks authentication/authorization checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, target individual orders, and search orders by customer name or email.
Risk Assessment
Disclosure of order and customer contact data may violate privacy and data security.
Recommendation
Update the plugin to version 4.2.0 or later.
Other vulnerabilities in Ni WooCommerce Sales Report
Original NVD description (English source)
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and to search the store's orders by customer name or email address.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS