CVE-2026-78474CWE-200information-disclosure

CVE-2026-78474

Medium · published September 16, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
32.4
In the wild
Unconfirmed
What it is

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and to search the store's orders by customer name or email address.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00394 · 32.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-16T10:16Z
References (1)
https://wpscan.com/vulnerability/9518db93-0cd9-4db5-af9b-5371218c8b50/ · [email protected]
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 16 SEP 06:00Z
    Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter
    cvelistv5