The WPFactory Advanced WooCommerce Product Sales Reporting plugin contains an improper neutralization of special elements in SQL commands, resulting in a Blind SQL Injection vulnerability (CVE-2026-24993). This vulnerability affects versions up to 4.1.3 and allows remote attackers to inject SQL commands without authentication, potentially exposing sensitive data. The CVSS 3.1 base score is 9.3 (critical), reflecting network attack vector, low complexity, no privileges or user interaction required, and a confidentiality impact rated high. No patch or official fix information is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform Blind SQL Injection attacks against the affected plugin, potentially leading to unauthorized disclosure of sensitive information. The integrity impact is rated none, but availability impact is low. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or removing the affected plugin if possible to mitigate risk. Monitor WPFactory communications for updates on patches or official fixes.