CVE-2026-4140

OVERVIEW CVE-2026-4140 is a Cross-Site Request Forgery vulnerability affecting the Ni WooCommerce Order Export plugin for WordPress in all versions through 3.1.6. The flaw exists in the ni_order_export_action() AJAX handler function, which fails to validate nonce tokens or verify user capabilities before processing plugin settings updates. This allows attackers to modify the plugin's configuration through forged requests if they can trick a site administrator into clicking a malicious link. SEVERITY The vulnerability carries a CVSS score of 4.3 (Medium) with a network-based attack vector, low complexity requirements, and no privilege escalation needed from the attacker. User interaction is required, as the administrator must be socially engineered to initiate the attack. The impact is limited to integrity, with no confidentiality or availability concerns, as attackers can only modify plugin settings without accessing sensitive data or disrupting service. EXPLOITATION STATUS The vulnerability is not currently listed on the KEV catalog and shows no active exploitation in the wild. The EPSS score of 0.00005 indicates minimal community attention relative to other CVEs. No publicly disclosed exploit code is documented, and threat intelligence suggests this remains a low-priority concern for immediate remediation, though administrators should update the plugin to version 3.1.7 or later when available.