CVE-2025-7827
📋 TL;DR
The Ni WooCommerce Customer Product Report plugin for WordPress has an authorization vulnerability that allows authenticated users with Subscriber-level access or higher to modify plugin settings without proper permissions. This affects all WordPress sites using the plugin version 1.2.4 or earlier. Attackers could change configuration options that might impact reporting functionality or site behavior.
💻 Affected Systems
- Ni WooCommerce Customer Product Report WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
An attacker could modify plugin settings to disrupt WooCommerce reporting functionality, potentially affecting business operations or altering data visibility for legitimate users.
Likely Case
Low-privileged users could change plugin configuration settings they shouldn't have access to, potentially affecting report generation or data display.
If Mitigated
With proper user role management and monitoring, impact would be limited to minor configuration changes that could be detected and reverted.
🎯 Exploit Status
Exploitation requires authenticated access with Subscriber-level permissions or higher. The vulnerability is in the ni_woocpr_action() function which lacks proper capability checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.2.5 or later
Vendor Advisory: https://wordpress.org/plugins/ni-woocommerce-customer-product-report/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Ni WooCommerce Customer Product Report'. 4. Click 'Update Now' if available, or download latest version from WordPress repository. 5. Activate updated plugin.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
WordPressDeactivate the vulnerable plugin until patched version is available
wp plugin deactivate ni-woocommerce-customer-product-report
User Role Restriction
WordPressTemporarily restrict Subscriber-level users from accessing the site
🧯 If You Can't Patch
- Deactivate the Ni WooCommerce Customer Product Report plugin completely
- Implement strict user role management and monitor for unauthorized configuration changes
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → Ni WooCommerce Customer Product Report. If version is 1.2.4 or lower, you are vulnerable.Check Version:
wp plugin get ni-woocommerce-customer-product-report --field=versionVerify Fix Applied:
After updating, verify plugin version shows 1.2.5 or higher in WordPress admin plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual plugin setting changes by non-admin users
- Multiple failed or successful ni_woocpr_action function calls from Subscriber accounts
Network Indicators:
- POST requests to admin-ajax.php with action=ni_woocpr_action from non-admin users
SIEM Query:
source="wordpress" AND (uri_path="*/admin-ajax.php" AND parameters.action="ni_woocpr_action") AND user_role!="administrator"