The vulnerability resides in the AJAX handler ni_order_export_action() of the Ni WooCommerce Order Export plugin. A missing nonce and lack of capability checks allow any user to send a forged request, which is then used to update the plugin’s options using update_option without authentication. An attacker can change the plugin’s settings, potentially altering export configuration. This is a classic Cross‑Site Request Forgery flaw (CWE‑352).

WordPress sites running the Ni WooCommerce Order Export plugin, version 3.1.6 and earlier, developed by anzia. The attack affects any WordPress installation that has the plugin installed and an administrator who can be lured into visiting a crafted URL.

With a CVSS score of 4.3 the vulnerability is considered moderate. No EPSS data is available, and it is not listed in the CISA KEV catalog. The attack requires the attacker to trick a site administrator or other privileged user into clicking a link that triggers the ni_order_export_action in the background, but no privileged credentials are needed to submit the request. If many sites use the affected plugin and administrators are social‑engineered, the risk of abuse is non‑negligible.