Unauthorized Data Modification in Ni WooCommerce Customer Product Report Plugin for WordPress

CVE-2025-7827

What is CVE-2025-7827?

The Ni WooCommerce Customer Product Report plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level access and above to perform unauthorized modifications of plugin settings. This issue arises from a lack of proper capability checks in the ni_woocpr_action() function, affecting all versions up to and including 1.2.4. It is crucial for users of this plugin to apply security measures to prevent unauthorized data updates.

References