CVE-2026-93528 in NP Quote Request for WooCommerce Plugin
Summary
by MITRE • 09/23/2026
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the NP Quote Request for WooCommerce WordPress plugin prior to version 2.4.16 represents a critical failure in access control mechanisms, specifically categorized under CWE-862 Missing Authorization and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. This flaw stems from the application's inability to validate whether the entity requesting data is the legitimate owner of that specific resource. In standard e-commerce architectures built on WordPress and WooCommerce, order details are typically protected by a combination of user session authentication for logged-in customers and unique, opaque identifiers such as order keys or hashes for guest checkout scenarios. The plugin in question fails to enforce these checks when rendering quote requests associated with existing orders, thereby bypassing the intended security boundaries established by the underlying platform.
From a technical perspective, the exploitation vector relies on the predictable nature of WooCommerce order structures and the lack of server-side validation during data retrieval operations. An unauthenticated attacker can enumerate valid order keys or utilize known patterns to construct malicious requests targeting specific customer orders. Because the plugin does not verify that the requester possesses ownership rights over the targeted order ID and its corresponding key, it proceeds to render sensitive details such as billing information, shipping addresses, product lists, pricing structures, and potentially payment status. This behavior effectively transforms what should be a private transaction record into publicly accessible data for any individual who can guess or obtain the relevant identifiers.
The operational impact of this vulnerability is severe due to the sensitivity of the exposed data. Customer privacy regulations such as GDPR in Europe or CCPA in California are directly violated by the unauthorized disclosure of personally identifiable information and purchase history. Beyond regulatory compliance issues, businesses face significant reputational damage and potential legal liability when customer trust is eroded through public exposure of private transactional details. Furthermore, this information leakage can facilitate further attacks including social engineering campaigns where attackers use acquired order data to craft convincing phishing messages or credential stuffing attempts against specific individuals who have recently made purchases from the affected site.
Mitigation strategies must prioritize immediate remediation by upgrading the NP Quote Request for WooCommerce plugin to version 2.4.16 or later, which addresses this authorization flaw through proper implementation of ownership verification logic. Until an update is applied, administrators should consider disabling any public-facing quote request features that interact with order data if not strictly necessary. Additionally, implementing Web Application Firewall rules can help detect and block anomalous requests targeting WooCommerce endpoints without valid session tokens or matching access credentials. Regular security audits focusing on broken object level authorization patterns are recommended to ensure similar vulnerabilities do not exist in other custom plugins or themes integrated within the WordPress ecosystem.