The Ni WooCommerce Customer Product Report plugin contains a missing capability check in the ni_woocpr_action() function for all releases up to version 1.2.4. This defect allows an attacker who is logged in with a Subscriber role or higher to change the plugin’s configuration settings without proper authorization. Altered settings could affect the accuracy of customer product reports, redirect data flows, or expose sensitive operational parameters, thereby compromising the integrity of the site’s reporting functionality.

Any WordPress installation that has the Ni WooCommerce Customer Product Report plugin version 1.2.4 or earlier installed, regardless of active theme or other plugins. The vendor is Anzia, and the product is the Ni WooCommerce Customer Product Report plugin.

The vulnerability has a CVSS score of 4.3, indicating moderate severity, and an EPSS score of less than 1 %, showing that opportunistic exploitation is unlikely. It is not listed in the CISA KEV catalogue. The attack vector is inferred to be local: an authenticated user must first log into the WordPress site with at least Subscriber privileges and then submit a request to the affected endpoint. No additional exploitation prerequisites or remote code execution are documented in the official description.