blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-78474

MEDIUM 5.3 CVSS 3.1
Published
September 16, 2026
Last modified
September 17, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-200
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and to search the store's orders by customer name or email address.

Affected products and versions

  • Unknown Ni WooCommerce Sales Report — Before 4.2.0

References

  • wpscan.com https://wpscan.com/vulnerability/9518db93-0cd9-4db5-af9b-5371218c8b50/
  • nvd.nist.gov Official NVD record