CVE-2026-24993
Blind SQL Injection in WPFactory WooCommerce Reporting Plugin
Publication date: 2026-03-25
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpfactory | advanced_woocommerce_product_sales_reporting | to 4.1.3 (inc) |
| wpfactory | advanced_woocommerce_product_sales_reporting_plugin | to 4.1.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24993 is a high-priority SQL Injection vulnerability found in the WordPress Advanced WooCommerce Product Sales Reporting Plugin versions up to 4.1.3.
This vulnerability allows unauthenticated attackers to inject malicious SQL commands into the plugin's database queries, enabling them to interact directly with the database.
It is classified under the OWASP Top 10 category A3: Injection and can be exploited without any authentication, making it highly critical.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized data theft or manipulation by attackers who exploit the SQL Injection flaw.
Because it requires no authentication, attackers can easily exploit it, potentially compromising sensitive sales data stored in the plugin's database.
The high CVSS score of 9.3 indicates a critical risk with a high likelihood of exploitation, often targeted in mass-exploit campaigns.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability allows unauthenticated attackers to interact directly with the plugin's database via SQL Injection, which can be detected by monitoring for unusual or suspicious SQL queries targeting the Advanced WooCommerce Product Sales Reporting Plugin.
While specific commands are not provided, detection can involve inspecting web server logs or database logs for unexpected SQL commands or injection patterns related to the plugin.
Additionally, enabling security tools such as Patchstack's automatic mitigation rules can help detect and block exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Advanced WooCommerce Product Sales Reporting Plugin to version 4.1.4 or later, where the vulnerability has been patched.
Until the update can be applied, users of Patchstack can enable automatic mitigation rules that block exploitation attempts.
Enabling auto-updates for vulnerable plugins is also recommended to ensure rapid protection against this critical SQL Injection vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to interact directly with the plugin's database, potentially leading to data theft or manipulation.
Such unauthorized access and potential data breaches could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access.
Therefore, failure to patch this vulnerability may result in non-compliance with these standards due to the increased risk of data exposure.