anzia vulnerabilities and threats

CVE-2026-4140 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ni WooCommerce Order Export WordPress plugin versions up to 3.1.6. The vulnerability arises from missing nonce validation in the AJAX handler that processes settings updates, allowing unauthenticated attackers to modify plugin settings if they can trick an administrator into performing an action such as clicking a malicious link. This vulnerability has a medium severity rating with a CVSS score of 4.3.

The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_woocpr_action() function in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings.

The Ni Sales Commission For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'niwoosc_ajax' AJAX endpoint in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and modify commission amounts.