CVE-2026-78472: Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter

Q: Which installations are affected?

WordPress sites using Ni WooCommerce Sales Report versions earlier than 4.2.0 are affected.

Q: Does exploitation require an account or administrative access?

No. The issue can be exploited by unauthenticated users.

Q: What input is involved in the attack?

The vulnerable input is the sort parameter, which is used in a SQL statement without sanitization and escaping.

Published Sep 16, 2026

Updated

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Event History

Sep 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

WordPress sites using Ni WooCommerce Sales Report versions earlier than 4.2.0 are affected.

Does exploitation require an account or administrative access?

No. The issue can be exploited by unauthenticated users.

What input is involved in the attack?

The vulnerable input is the sort parameter, which is used in a SQL statement without sanitization and escaping.