CVE-2026-78472

HighCVSS 8.6

Published: 16/09/2026(UTC)Updated: 17/09/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Ni WooCommerce Sales Report plugin before 4.2.0 does not sanitise and escape a parameter before using it in SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Risk Assessment

SQL injection can lead to full database compromise, including customer and order data.

Recommendation

Update the plugin to version 4.2.0 or later.

Other vulnerabilities in Ni WooCommerce Sales Report

CVE-2026-78474Medium
The Ni WooCommerce Sales Report plugin before 4.2.0 lacks authentication/authorization checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, target individual orders, and search orders by customer name or email.

Original NVD description (English source)

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS