Vulnerability Report

CVE-2026-93528

Title: Unauthenticated order details viewing in NP Quote Request for WooCommerce

Information Disclosure

Proof Of Concept

PoC Available for CVE-2026-93528

CWE Category NVD-CWE-noinfo

Published Date Sep 23, 2026

Modified Date Sep 23, 2026

Exploit Status Available

Score 3.7 CVSS v

Exploit Probability (EPSS)

0.22%

Vulnerability Summary

CVE-2026-93528: The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.

Impacted Vendors

Analysis in Progress...

Reference Links

https://wpscan.com/vulnerability/f691b9cc-7d17-4308-9646-db842d99f63f/

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity LOW

3.7

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-93528 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/muradislamzada/CVE-2026-93528

View Code

September 23, 2026 MODIFIED

Vulnerability data updated via NVD.

September 23, 2026 MODIFIED

Vulnerability data updated via NVD.

September 23, 2026 MODIFIED

Vulnerability data updated via NVD.

September 23, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity HIGH

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Stack

No specific products linked.