Security Alert Summary
A vulnerability in the NP Quote Request for WooCommerce WordPress plugin (CVE-2026-93528) allows an unauthenticated attacker to view another customer’s order details by using the order’s key. The issue exists because the plugin does not verify order ownership before rendering order information.
CVE Details
- CVE ID: CVE-2026-93528
- Affected component: NP Quote Request for WooCommerce WordPress plugin
- Affected versions: Versions before 2.4.16. The advisory lists version 2.0 as affected (lessThan 2.4.16).
- Published: September 23, 2026 at 6:17:06 AM UTC
- Last modified: September 23, 2026 at 11:17:18 AM UTC
- CVSS v3.1: Base Score 3.7 (LOW) — Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction:
- Privileges Required: NONE
- User Interaction: NONE
- Attack Vector: NETWORK
- Attack Complexity: HIGH
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-200 (Exposure of Sensitive Information)
Technical Details
The plugin fails to verify order ownership before rendering an order’s details. As described in the advisory, an attacker who knows or can guess an order’s key can request the order page and receive another customer’s order information without authentication. The root cause is a missing authorization check that should ensure the requesting user is the order owner before sensitive data is displayed.
No specific function names or REST endpoints are provided in the advisory. The named artifact in the disclosure is the order key: the ability to supply a valid order key and receive order details is what enables information disclosure.
Impact is limited to disclosure of order-related information. According to the CVSS data, there is no integrity or availability impact from this issue as reported.
How This Could Impact Your Website
On a multi-user WordPress site the site owner, internal staff (for example store managers or shop editors), and external contractors or contributors may all rely on order pages to view customer information. If this plugin is present and an attacker obtains or guesses an order key, they could view another customer’s order details without logging in.
Practical consequences include exposure of customer contact details or order items, which can increase the risk of targeted phishing or social engineering against customers or staff. Disclosure of internal user email addresses (for example if staff names or emails appear on order records) can also expand the attack surface for scams.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level and other low-privilege roles that may still have access to sensitive views.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual behavior, such as repeated requests for order pages using different order keys.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
