CVE-2026-78472 Overview
CVE-2026-78472 is an unauthenticated SQL injection vulnerability in the Ni WooCommerce Sales Report WordPress plugin versions prior to 4.2.0. The plugin fails to sanitize and escape a user-controlled parameter before inserting it into a SQL statement. Attackers can send crafted HTTP requests to execute arbitrary SQL queries against the WordPress database without authentication. The flaw maps to CWE-89, Improper Neutralization of Special Elements used in a SQL Command. Because exploitation requires no privileges or user interaction, any WordPress site running an affected version is reachable directly from the internet.
Critical Impact
Unauthenticated attackers can extract sensitive data from WordPress databases, including customer records, order details, and administrator credentials.
Affected Products
- Ni WooCommerce Sales Report WordPress plugin versions before 4.2.0
- WordPress sites running WooCommerce with the vulnerable plugin installed
- All hosting environments exposing the plugin endpoint to unauthenticated network traffic
Discovery Timeline
- 2026-09-16 - CVE-2026-78472 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-78472
Vulnerability Analysis
The Ni WooCommerce Sales Report plugin builds a SQL statement using a request parameter without proper sanitization or escaping. An unauthenticated attacker submits crafted input that breaks out of the intended query context and appends attacker-controlled SQL clauses. The resulting query executes with the privileges of the WordPress database user, exposing arbitrary rows across WooCommerce tables. The scope is marked as changed under the CVSS vector, indicating the impact extends beyond the vulnerable component to the underlying database.
Root Cause
The root cause is missing input validation on a parameter consumed by a SQL query. WordPress provides the $wpdb->prepare() API and helper functions such as esc_sql() for parameterized queries. The vulnerable code path concatenates untrusted input directly into the query string, ignoring these safe primitives. This pattern is the canonical CWE-89 defect.
Attack Vector
Exploitation occurs over the network against the plugin's public request handler. An attacker sends an HTTP request containing SQL metacharacters in the vulnerable parameter. UNION-based or time-based blind techniques allow the attacker to enumerate the schema and exfiltrate data from wp_users, wp_usermeta, and WooCommerce order tables. See the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-78472
Indicators of Compromise
- HTTP requests to Ni WooCommerce Sales Report plugin endpoints containing SQL keywords such as UNION SELECT, SLEEP(, BENCHMARK(, or encoded quote characters
- Unexpected database errors in wp-content/debug.log referencing plugin query strings
- Anomalous outbound traffic from the web server following requests to the plugin's admin-ajax or REST routes
Detection Strategies
- Deploy WAF rules that block SQL metacharacter patterns in requests targeting /wp-admin/admin-ajax.php and plugin-specific routes
- Enable MySQL general query logging temporarily to identify malformed queries containing tautologies like OR 1=1
- Correlate web server access logs with database error logs to detect probing attempts
Monitoring Recommendations
- Alert on spikes in 500-series HTTP responses from WordPress endpoints associated with the plugin
- Monitor for unauthenticated requests carrying sleep, information_schema, or sysobjects tokens
- Track baseline query volume and flag deviations that suggest automated SQL injection scanning
How to Mitigate CVE-2026-78472
Immediate Actions Required
- Update the Ni WooCommerce Sales Report plugin to version 4.2.0 or later on every affected WordPress site
- If patching is not immediately possible, deactivate and remove the plugin until the update is applied
- Rotate WordPress administrator passwords and WooCommerce API keys if exploitation is suspected
Patch Information
The vendor addressed the flaw in version 4.2.0 of the Ni WooCommerce Sales Report plugin. Install the update through the WordPress plugin manager or by replacing the plugin directory with the patched release. Verify the installed version in wp-admin/plugins.php after applying the fix. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict access to WordPress admin and AJAX endpoints using IP allow-lists at the reverse proxy or WAF layer
- Deploy virtual patching signatures in a WAF to reject requests containing SQL injection payloads against the plugin routes
- Enforce least-privilege on the WordPress database user by removing rights such as FILE, CREATE, and DROP where not required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
