The vulnerability occurs when user input is not properly neutralised in an SQL statement within the Advanced WooCommerce Product Sales Reporting plugin, enabling an attacker to inject arbitrary SQL commands. This flaw can lead to unauthorized access to sensitive data or modification of database contents. The CVSS score of 9.3 and its CWE-89 classification reflect the severity of the data compromise risk.

Affected versions are all releases of the WPFactory Advanced WooCommerce Product Sales Reporting plugin from the earliest available release through version 4.1.1. WordPress sites that employ this plugin in their e‑commerce setup are at risk.

The EPSS score of less than 1% indicates that exploitation is currently uncommon, but the high CVSS rating denotes a severe security risk. Based on the description, it is inferred that an attacker could send specially crafted HTTP requests to the plugin’s endpoints that incorporate user‑controlled input into SQL queries. Although the vulnerability is not yet listed in the CISA KEV catalog, the severe score justifies prompt remediation.