The Ni WooCommerce Order Export plugin for WordPress contains a CSRF vulnerability due to the absence of nonce validation in the ni_order_export_action() AJAX handler. This handler processes settings updates when the 'page' parameter equals 'nioe-order-settings' by calling Ni_Order_Setting::page_ajax(), which updates plugin options via update_option('ni_order_export_option', $_REQUEST) without verifying a nonce or user capabilities. Consequently, an attacker can craft a forged request that, if executed by an authenticated administrator, modifies plugin settings without authorization.

An attacker can cause unauthorized changes to the plugin's settings by exploiting the CSRF vulnerability, potentially altering the behavior of the Ni WooCommerce Order Export plugin. However, the vulnerability requires tricking an authenticated administrator into performing an action, and it does not directly lead to data confidentiality loss or denial of service. The impact is limited to integrity modification of plugin settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should avoid clicking untrusted links and consider restricting access to the plugin's settings page. Monitoring for updates from the vendor is recommended to apply an official fix once released.