Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-93528: NP Quote Request for WooCommerce lets strangers see order details
CVE-2026-93528 · published 1 month ago
Summary
The NP Quote Request for WooCommerce add‑on (versions before 2.4.16) shows a customer’s order information without confirming the viewer’s identity. This means anyone who knows an order’s key could look at another shopper’s purchase details. Update the plugin to the latest version or limit access to the quote request page to protect customer data.
What to do
- Update unknown np quote request for woocommerce to version 2.4.16 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | np quote request for woocommerce | < 2.4.16 |
Original advisory text
NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.7
Low
Type
CWE-200Information Exposure
Timeline
Published23 Sep 2026
Updated3 Nov 2026
First seen23 Sep 2026
Track software like this
Free during beta