The Ni WooCommerce Order Export WordPress plugin versions up to 3.1.6 contain a CSRF vulnerability due to missing nonce validation in the ni_order_export_action() AJAX handler. This handler updates plugin settings by calling update_option('ni_order_export_option', $_REQUEST) without verifying a nonce or checking user capabilities, enabling unauthenticated attackers to modify plugin settings if they can trick an administrator into performing an action such as clicking a malicious link. The vulnerability is tracked as CVE-2026-4140 with a CVSS 3.1 base score of 4.3 (medium severity). No patch or official remediation has been published by the vendor as of the information provided.

An attacker can modify the plugin's settings without proper authorization by exploiting the CSRF vulnerability, potentially leading to unauthorized configuration changes. This requires the attacker to trick an authenticated administrator into performing an action, such as clicking a crafted link. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links and consider limiting administrative access or disabling the plugin if feasible. Monitoring for updates from the vendor is recommended.