WordPress Plugin Vulnerabilities

Ni WooCommerce Sales Report < 3.7.4 - Subscriber+ Sale & Order Reports Access

Description

The plugin is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_sales_order' function, allowing authenticated attackers, with subscriber-level access and above, to view sales and order reports.

Affects Plugins

Plugin icon
ni-woocommerce-sales-report
Fixed in 3.7.4

References

CVE
CVE-2023-32299
URL
https://patchstack.com/database/vulnerability/ni-woocommerce-sales-report/wordpress-ni-woocommerce-sales-report-plugin-3-7-2-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Jonas Höbenreich
Verified
No
WPVDB ID
18d91672-b4be-4ce7-81e4-314c594b3d16

Timeline

Publicly Published
2023-10-25 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-04-01 (about 2 years ago)

Other

Published
Title
Published
2024-08-27
Title
Permalink Manager Lite < 2.4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Published
2024-04-16
Title
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) < 3.1.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Published
2025-10-25
Title
FileBird Pro < 6.5.2 - Missing Authorization
Published
2024-04-24
Title
PropertyHive < 2.0.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Published
2024-01-31
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.7 - Missing Authorization via set_starred()