Authentication Bypass in Ni WooCommerce Sales Report Plugin by Ni
CVE-2026-78474
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 September 2026
Badges
What is CVE-2026-78474?
The Ni WooCommerce Sales Report plugin, prior to version 4.2.0, is susceptible to an authentication bypass vulnerability. Attackers can exploit this flaw to access sensitive information, including WooCommerce order details and customer contact information, without any authentication or authorization checks. This lack of security allows unauthorized users to specifically target individual orders and search through the store's order history by customer name or email address, posing a significant risk to customer privacy and data integrity.
Affected Version(s)
Ni WooCommerce Sales Report 0 < 4.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.