CVE-2026-24993

Critical

Published: 25 March 2026

Published

25 March 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

EPSS Score 0.0028 19.9th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-24993 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-24993 is an SQL Injection vulnerability, classified as Improper Neutralization of Special Elements used in an SQL Command (CWE-89), that enables Blind SQL Injection in the WPFactory Advanced WooCommerce Product Sales Reporting plugin, also known as webd-woocommerce-advanced-reporting-statistics. This issue affects all versions of the plugin from n/a through 4.1.3 and was published on 2026-03-25.

The vulnerability carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating it is exploitable by unauthenticated attackers over the network with low attack complexity and no user interaction required. Exploitation changes the scope, allowing high confidentiality impact through data extraction via blind SQL injection techniques, with no integrity impact and low availability impact.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/webd-woocommerce-advanced-reporting-statistics/vulnerability/wordpress-advanced-woocommerce-product-sales-reporting-plugin-4-1-3-sql-injection-vulnerability?_s_id=cve.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-15608

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Blind SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.3.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Blind SQL injection (CWE-89) in public-facing WordPress plugin directly enables remote unauthenticated exploitation of a web application per T1190, resulting in high-impact data extraction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0