CVE-2025-7827 identifies a missing capability check in the ni_woocpr_action() function of the Ni WooCommerce Customer Product Report plugin for WordPress, affecting all versions up to and including 1.2.4. This authorization bypass vulnerability permits authenticated users with minimal privileges (Subscriber-level and above) to update plugin settings, potentially leading to unauthorized configuration changes. The vulnerability is rated medium severity with a CVSS score of 4.3 and does not impact confidentiality or availability, only integrity of plugin settings.

Authenticated users with Subscriber-level access or higher can modify plugin settings without proper authorization. This could lead to unauthorized changes in plugin behavior or configuration but does not directly affect data confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for plugin updates from the vendor. Avoid granting unnecessary privileges to users and consider disabling or replacing the plugin if unauthorized modification risk is unacceptable.