SQL Injection Vulnerability in Ni WooCommerce Sales Report WordPress Plugin
CVE-2026-78472

Currently unrated

Key Information:

Vendor

WordPress
Status
Ni WooCommerce Sales Report
Vendor
CVE Published:
16 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-78472?

The Ni WooCommerce Sales Report WordPress plugin, prior to version 4.2.0, suffers from an SQL injection vulnerability due to insufficient sanitization and escaping of a specific parameter in its SQL statements. This flaw enables attackers to execute arbitrary SQL queries, potentially exposing sensitive data or compromising site integrity, especially as it allows unauthenticated users to launch attacks without any prior authentication. It is crucial for users of this plugin to update to the latest version to safeguard against these exploitation risks.

Affected Version(s)

Ni WooCommerce Sales Report 0 < 4.2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-78472 - Proof of Concept

References

https://wpscan.com/vulnerability/5bc6a6ec-cc7e-493a-977e-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwan LR (WPScan)
WPScan
.