The Advanced WooCommerce Product Sales Reporting plugin contains a flaw that allows sensitive user and transaction details to be embedded in exported data or reports. When a user or attacker accesses the reporting functionality, confidential information such as names, addresses, or credit card numbers can be inadvertently revealed. This issue falls under CWE‑201 and can compromise the confidentiality of customer data.

The vulnerability exists in the WPFactory‑derived Advanced WooCommerce Product Sales Reporting plugin for WordPress. Affected releases range from the earliest available versions up to and including version 4.1.2. Any site running these plugin versions, regardless of WordPress version, is potentially impacted.

The CVSS score of 5.3 rates the vulnerability as moderate, and the EPSS score of less than 1% indicates a very low probability of exploitation at present. The issue is not listed in CISA’s KEV catalog. An attacker could exploit the vulnerability by triggering the plugin’s data export or report generation features, which are typically accessed via the WordPress admin interface. Since the vulnerability requires only access to the reporting endpoints, anyone with sufficient site privileges—or a guest who can initiate a report request if the plugin is publicly exposed—could acquire the leaked data.