CVE-2026-78474: Ni WooCommerce Sales Report Plugin Leak

CVE-2026-78474 Overview

CVE-2026-78474 affects the Ni WooCommerce Sales Report WordPress plugin in versions prior to 4.2.0. The plugin exposes a report-printing routine without authentication or authorization checks. Unauthenticated attackers can query the endpoint to retrieve WooCommerce order details and customer contact information. The flaw also allows adversaries to target individual orders and search a store's orders by customer name or email address. This is an information disclosure weakness classified under [CWE-200].

Critical Impact
Unauthenticated remote attackers can enumerate WooCommerce order records and customer personally identifiable information (PII) directly from vulnerable stores.

Affected Products

Ni WooCommerce Sales Report WordPress plugin versions prior to 4.2.0
WordPress sites running WooCommerce with the affected plugin installed
Store deployments where the plugin's report endpoint is reachable over the network

Discovery Timeline

2026-09-16 - CVE-2026-78474 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-78474

Vulnerability Analysis

The Ni WooCommerce Sales Report plugin ships a report-printing routine intended for authorized store operators. The routine is registered as a request handler but does not verify the caller's authentication state or capability. Any anonymous HTTP request that reaches the endpoint receives the same output an administrator would. The response includes WooCommerce order data such as buyer name, email address, and order line items. Attackers can also supply search parameters to filter by customer name or email, converting the endpoint into a lookup service for store customer records.

Root Cause

The root cause is missing authentication and authorization checks on a sensitive plugin request handler. The routine omits both is_user_logged_in() verification and any current_user_can() capability check before returning order data. This maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Attack Vector

Exploitation requires only network access to the WordPress site. No credentials, user interaction, or elevated privileges are needed. An attacker issues HTTP requests to the vulnerable report endpoint, optionally passing search parameters, and parses the returned order and customer data. Refer to the WPScan Vulnerability Advisory for endpoint specifics.

Detection Methods for CVE-2026-78474

Indicators of Compromise

Unauthenticated HTTP requests to the Ni WooCommerce Sales Report plugin's report-printing endpoint from external IP addresses.
Repeated requests containing customer name or email search parameters against the plugin endpoint.
Anomalous outbound response sizes from the WordPress site correlated with plugin URL paths.

Detection Strategies

Inventory WordPress installations and identify sites running the Ni WooCommerce Sales Report plugin below version 4.2.0.
Review web server access logs for requests to plugin routes lacking an authenticated session cookie.
Correlate WooCommerce order access events with the identity of the requesting user; anonymous access to order data is a strong signal.

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end and forward logs to a centralized analytics platform for retention and search.
Configure web application firewall (WAF) rules to alert on unauthenticated hits against known-vulnerable plugin endpoints.
Monitor for scraping patterns such as sequential order ID enumeration or high-volume email parameter variations.

How to Mitigate CVE-2026-78474

Immediate Actions Required

Upgrade the Ni WooCommerce Sales Report plugin to version 4.2.0 or later on all affected WordPress sites.
Audit web server and WooCommerce logs for prior unauthenticated access to the report endpoint and assess PII exposure.
Notify affected customers if evidence indicates their order or contact data was retrieved by unauthorized parties.

Patch Information

The vendor addressed the issue in Ni WooCommerce Sales Report plugin version 4.2.0 by adding authentication and authorization checks to the affected report-printing routine. See the WPScan Vulnerability Advisory for advisory details.

Workarounds

If patching is not immediately possible, deactivate the Ni WooCommerce Sales Report plugin until the upgrade can be applied.
Block external access to the plugin's report endpoint at the WAF or reverse proxy layer while allowing internal administrative traffic.
Restrict /wp-admin and plugin-related paths by IP allowlist where operationally feasible.

bash

# Example WAF rule concept: block unauthenticated requests to the plugin endpoint
# Adjust the location match to the specific route documented in the WPScan advisory.
location ~* /wp-content/plugins/ni-woocommerce-sales-report/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}