Super Store Finder CVE-2026-108541

Exploitation requires the attacker to reach /products/superstorefinder/index.php and supply malicious input in the 'lat' or 'lng' request parameters, which are passed into a SQL query without proper sanitization. Per the provided CVSS vector (PR:L), the attacker must hold low-level privileges/authentication within the application, which limits purely anonymous exploitation; no user interaction (UI:N) and no special attack requirements (AT:N) are needed. Affected deployments are Super Store Finder version 3.8 and earlier; upgrading to 3.9 removes the condition. The practical limiting factors are the authentication requirement and the plugin's limited deployment footprint.

This is a moderate, not high-priority, issue. The authoritative CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 (medium): network-reachable and low-complexity, but requiring low-level privileges (PR:L) and yielding only low confidentiality, integrity, and availability impact on the vulnerable system with no scope change. The vector's E:P (Proof-of-Concept) sub-metric aligns with the description's statement that the exploit has been publicly disclosed, so publicly available exploit code exists - but this is distinct from active exploitation. The CVE is not listed in CISA KEV and no EPSS score was provided in the input, so there is no signal of widespread or confirmed real-world exploitation; disclosure is via VulDB, a vulnerability database, rather than an incident-response source. For a CWE-89 SQL injection the VC:L/VI:L/VA:L (rather than High) impact rating is somewhat conservative and may reflect VulDB's scoring convention - real-world impact could be higher depending on database privileges and data sensitivity, which defenders should verify. Net: a credentialed SQL injection in a niche commercial PHP plugin with a vendor patch already available - worth patching promptly where deployed, but not an emergency given the low deployment footprint, authentication requirement, and absence of KEV/active-exploitation signals.

An attacker with low-privilege access to the application submits a crafted value in the 'lat' or 'lng' parameter to /products/superstorefinder/index.php, injecting SQL that the store-locator query executes against the backend database. Because the exploit has been publicly disclosed, a working proof-of-concept is available to lower the barrier to reproduction. The low attack complexity (AC:L) means no special timing or conditions are needed once the attacker holds the required privileges.