The vulnerability is a blind SQL injection flaw caused by improper sanitization of user input in WPFactory's Advanced WooCommerce Product Sales Reporting plugin. An attacker can send crafted queries that are executed on the underlying database, potentially allowing confidential data to be read, modified, or deleted. The weakness is a classic Injection flaw as defined by CWE-89.

The affected product is the WordPress plugin Advanced WooCommerce Product Sales Reporting developed by WPFactory. Versions from the initial release through 4.1.3 (inclusive) are vulnerable. Users running any of these releases should consider upgrading.

The CVSS score of 9.3 classifies the issue as critical, indicating high severity. The EPSS score is less than 1 %, suggesting low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. Attackers would need to interact with the plugin’s input fields, likely via the WordPress administration interface or possibly exposed front‑end endpoints, and rely on a blind injection technique where they infer database information through timing or boolean responses.