Executive brief
The Ni WooCommerce Sales Report plugin, used by WooCommerce store owners to generate sales analytics, contains an SQL injection vulnerability that can be exploited by unauthenticated attackers. An attacker can manipulate a search parameter to inject malicious SQL commands, potentially gaining unauthorized access to the entire WordPress database including customer payment information, personal details, and admin credentials.
Technical details
The vulnerability is an unauthenticated SQL injection (CWE-89) in the Ni WooCommerce Sales Report WordPress plugin before version 4.2.0. The plugin fails to sanitize and escape the 'sort' parameter before inserting it into a SQL statement. This allows an unauthenticated attacker to craft a malicious request with specially crafted SQL code in the sort parameter, which will be executed by the database. The attack vector is network-based and requires no authentication or user interaction. An attacker can extract sensitive data, modify database records, or potentially achieve remote code execution depending on the database configuration and plugin permissions.
Affected products
- Ni WooCommerce Sales Report before 4.2.0
Timeline
- 2026-09-14: disclosed: Publicly disclosed on WPScan
- 2026-09-14: patched: Fix available in version 4.2.0