What is the CVSS score of CVE-2026-24993?

CVE-2026-24993 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Advanced Woocommerce Product Sales Reporting are affected by CVE-2026-24993?

CVE-2026-24993 presents critical security risk, a SQL injection vulnerability rated CVSS 9.3.

How to fix or mitigate CVE-2026-24993?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Advanced Woocommerce Product Sales Reporting CVE-2026-24993

EUVD-2026-15608 CRITICAL

SQL Injection (CWE-89)

2026-03-25 Patchstack

GHSA-469r-7p32-pj7f

WordPress SQLi Advanced Woocommerce Product Sales Reporting Wordpress Plugin Wpfactory

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15608

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Blind SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.3.

AnalysisAI

A blind SQL injection vulnerability exists in WPFactory's Advanced WooCommerce Product Sales Reporting plugin (versions through 4.1.3) that allows attackers to execute arbitrary SQL commands against the underlying database. This WordPress plugin is widely deployed on e-commerce sites using WooCommerce, and the blind SQL injection technique enables attackers to extract sensitive data without requiring direct error message feedback. While no CVSS score, EPSS value, or KEV status has been assigned at this time, the vulnerability is classified as CWE-89 (SQL Injection) and has been documented by Patchstack, indicating active research and potential proof-of-concept availability.

Technical ContextAI

The vulnerability stems from improper neutralization of special SQL metacharacters in the webd-woocommerce-advanced-reporting-statistics plugin (identified via CPE: cpe:2.3:a:wpfactory:advanced_woocommerce_product_sales_reporting:*:*:*:*:*:*:*:*). This is a classic CWE-89 SQL injection flaw where user-supplied input is concatenated directly into SQL queries without proper parameterization or prepared statement usage. The plugin is a WordPress add-on designed for WooCommerce product sales reporting and analytics; it likely processes user input from administrative dashboards, REST API endpoints, or database query filters without adequate input validation and output encoding. Blind SQL injection specifically indicates that the attacker cannot see error messages or query results directly in the application response, requiring time-based or boolean-based inference techniques to extract data.

RemediationAI

Immediately update Advanced WooCommerce Product Sales Reporting to a version newer than 4.1.3 as soon as the vendor releases a patch; check the official WordPress plugin repository (wordpress.org/plugins/webd-woocommerce-advanced-reporting-statistics/) or contact WPFactory directly for patch availability and release notes. If a patched version is not yet available, disable or deactivate the plugin until a fix is released, as blind SQL injection poses significant data exfiltration and integrity risks. As a temporary defensive measure, restrict access to the plugin's administrative pages and reporting endpoints using WordPress security plugins (e.g., Wordfence, Sucuri) or server-level rules, limit database user privileges to read-only where possible, and monitor database query logs for suspicious activity patterns consistent with SQL injection attempts. Additionally, ensure WordPress, WooCommerce, and all other plugins are kept up to date, and conduct a security audit to detect any prior unauthorized database access.