CVE-2026-93528 Overview
CVE-2026-93528 affects the NP Quote Request for WooCommerce WordPress plugin in versions before 2.4.16. The plugin fails to verify order ownership before rendering order details. Unauthenticated attackers can view another customer's order by supplying the order's key. The flaw is categorized as an information disclosure weakness [CWE-200].
The vulnerability requires knowledge or guessing of a valid order key, which raises attack complexity. Successful exploitation exposes customer order information without authentication. No integrity or availability impact is associated with this issue.
Critical Impact
Unauthenticated attackers who obtain or guess a valid order key can retrieve another customer's order details, exposing personally identifiable information (PII) and purchase data.
Affected Products
- NP Quote Request for WooCommerce WordPress plugin versions prior to 2.4.16
- WordPress sites running WooCommerce with the affected plugin installed
- Any e-commerce deployment relying on the plugin's order-viewing functionality
Discovery Timeline
- 2026-09-23 - CVE-2026-93528 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-93528
Vulnerability Analysis
The NP Quote Request for WooCommerce plugin exposes an order-detail rendering path that accepts an order key as a request parameter. The plugin retrieves and displays the order tied to that key without validating that the requesting session owns the order. This is a broken access control flaw resulting in information disclosure [CWE-200].
Because the check is missing entirely rather than weakly implemented, any client presenting a valid key receives the order's content. The order key is a pseudo-random token, so exploitation requires the attacker to obtain a key through leakage, referrer headers, shared links, log exposure, or brute-force attempts across the key space. This dependency on key acquisition is why the issue is rated with high attack complexity.
Disclosed data typically includes customer name, billing and shipping addresses, email address, phone number, purchased items, quantities, and pricing. There is no impact to data integrity or site availability.
Root Cause
The root cause is a missing authorization check in the order-rendering handler. The plugin treats possession of the order key as sufficient proof of access, without cross-referencing the authenticated user or session against the order's owner. This is a classic Insecure Direct Object Reference (IDOR) pattern applied to a token-based identifier.
Attack Vector
An unauthenticated attacker crafts an HTTP request to the plugin's order-view endpoint, supplying a target order key. If the key is valid, the server returns the rendered order details. Keys can be harvested from browser history, email forwards, shared quote links, HTTP referrer leakage, or web server access logs.
No verified public exploit code is available for CVE-2026-93528. See the WPScan Vulnerability Report for advisory details.
Detection Methods for CVE-2026-93528
Indicators of Compromise
- Repeated HTTP GET requests to plugin endpoints containing order_key or similar parameter names from unauthenticated sessions.
- Sequential or high-volume request patterns targeting order-view URLs with varying key values.
- Requests to order-detail URLs originating from IP addresses that never authenticated to the WordPress site.
Detection Strategies
- Enable WordPress access logging and review web server logs for anomalous access to plugin routes handling order rendering.
- Deploy a Web Application Firewall (WAF) rule to flag unauthenticated access attempts to order-detail endpoints.
- Correlate high volumes of 200-response order-view requests from single source IPs, indicating potential key enumeration.
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized SIEM for query and alerting on plugin URL patterns.
- Alert on bursts of requests to the plugin's quote and order-view endpoints outside normal customer traffic baselines.
- Track outbound data volumes from the WordPress host to identify large-scale scraping activity.
How to Mitigate CVE-2026-93528
Immediate Actions Required
- Update the NP Quote Request for WooCommerce plugin to version 2.4.16 or later on all affected WordPress sites.
- Audit web server access logs for prior unauthenticated requests to plugin order-view endpoints and identify potentially exposed orders.
- Notify customers whose orders may have been accessed, in line with applicable data protection obligations.
Patch Information
Upgrade the NP Quote Request for WooCommerce plugin to version 2.4.16 or later. Refer to the WPScan Vulnerability Report for the fixed version and remediation guidance.
Workarounds
- Disable the NP Quote Request for WooCommerce plugin until the update to 2.4.16 or later can be applied.
- Restrict access to the plugin's order-view endpoints at the WAF or reverse proxy layer to authenticated sessions only.
- Rotate existing order keys where the plugin supports regeneration, invalidating keys that may have been exposed.
# Example WP-CLI command to update the plugin
wp plugin update np-quote-request-for-woocommerce --version=2.4.16
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
