OCTOBER 14, 2026
Live Feed
Back to database
Case File

CVE-2026-78472

HIGH · CVSS 8.6 EPSS 0.45%

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The Ni WooCommerce Sales Report plugin for WordPress versions prior to 4.2.0 is vulnerable to SQL injection due to improper sanitization and escaping of user-supplied parameters in SQL statements. This flaw allows unauthenticated users to execute arbitrary SQL queries, potentially compromising the integrity of the database. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.

CVE
CVE-2026-78472
Severity
HIGH
CVSS
8.6
EPSS
0.45%
WordPress

Original NVD Description

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.