Super Store Finder CVE-2025-58939
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-accessible CSRF requiring no attacker auth (PR:N) but mandatory victim interaction (UI:R); integrity-only impact from forged state-changing requests, no confidentiality or availability consequence.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in highwarden Super Store Finder superstorefinder-wp allows Cross Site Request Forgery.This issue affects Super Store Finder: from n/a through <= 7.5.
AnalysisAI
Cross-Site Request Forgery in the Super Store Finder WordPress plugin (versions through 7.5) enables remote unauthenticated attackers to perform unauthorized state-changing actions by forging requests on behalf of authenticated users. The plugin fails to implement WordPress nonce validation on one or more sensitive endpoints, meaning a logged-in administrator tricked into visiting a malicious page can have plugin data or settings modified without consent. With an EPSS of 0.02% (4th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a genuine but low-urgency finding appropriate for routine patch cycles.
Technical ContextAI
Super Store Finder is a WordPress plugin providing store locator and mapping functionality, distributed via the WordPress plugin repository under the slug superstorefinder-wp. CWE-352 (Cross-Site Request Forgery) describes the root cause: the application fails to verify that state-changing HTTP requests were intentionally submitted by the authenticated user, typically because the affected endpoint omits WordPress nonce (wp_nonce) validation. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U confirms the vulnerability is network-accessible, low complexity, requires no attacker authentication, but mandates user interaction - consistent with classic CSRF mechanics where the victim's browser automatically supplies session credentials to the forged request. No CPE string was included in the source data; the affected version boundary is stated as through 7.5 inclusive per NVD.
Affected ProductsAI
The Super Store Finder plugin by highwarden for WordPress, all versions from the initial release through and including version 7.5, is confirmed affected. The plugin is available under the WordPress.org slug superstorefinder-wp. No CPE string was provided in the source data. Full vulnerability details and patch guidance are available at the Patchstack advisory: https://patchstack.com/database/Wordpress/Plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-plugin-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
RemediationAI
Update the Super Store Finder plugin to a version beyond 7.5 once a patched release is confirmed available - the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-plugin-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve should be consulted for the exact fixed version, as no confirmed patch version number was present in the available source data. If immediate patching is not possible, restrict WordPress admin dashboard access to trusted IP ranges using server-level controls (e.g., Nginx/Apache allow/deny directives or a WAF rule), which prevents the forged request from reaching the vulnerable endpoint even if triggered. Deactivating the plugin until a patch is applied is a low-impact interim workaround given its non-core nature. Administrators should also avoid browsing untrusted sites while authenticated to their WordPress backend as a general hygiene measure.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today