CVE-2026-93528: NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
Published Sep 23, 2026
·Updated
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.
Affected Software
1 affected component
NP Quote Request for WooCommerce<2.4.16
Event History
Sep 23, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations should be prioritized for remediation?
WordPress sites running NP Quote Request for WooCommerce versions earlier than 2.4.16 are affected.
2
What must an attacker obtain to access another customer's order details?
The attacker needs the target order's key. The issue does not require the attacker to authenticate as the order owner.
3
What information can be exposed through successful exploitation?
An attacker can view another customer's order details through the quote request page.