Super Store Finder CVE-2026-12965

Exploitation requires only that the Super Store Finder WordPress plugin (version ≤7.8) be installed and active on the target site; the vulnerable AJAX action is registered for unauthenticated (nopriv) users, so no login, user interaction, or non-default configuration is needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is deployment scope - the site must actually run this specific plugin - rather than any authentication or platform constraint; the injectable request parameter must be reachable via the plugin's public AJAX handler. No special feature toggle is indicated by the description as a prerequisite.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a high-severity, network-reachable, unauthenticated, low-complexity flaw, and SSVC reinforces this by marking exploitation as poc, automatable=yes, and technical impact=total - all signals pointing to a genuine, easily weaponizable priority for any site running the plugin. Counterbalancing this, the EPSS score is only 0.19% (9th percentile) and the CVE is NOT in CISA KEV, indicating no evidence of widespread or active exploitation yet; the low EPSS likely reflects the plugin's limited deployment footprint rather than any difficulty of exploitation. Note a minor conflict worth verifying: the description states only that attackers can 'extract data' (a confidentiality/read impact), yet the published CVSS assigns I:H - the integrity-high rating is not clearly supported by the description and should be confirmed against the WPScan advisory. Overall this is a real, exploit-available issue that should be patched promptly on affected sites, but the absence of KEV/high-EPSS suggests opportunistic rather than mass-scanning exploitation to date.

An unauthenticated attacker sends a crafted HTTP request to the plugin's vulnerable AJAX endpoint (admin-ajax.php) with a malicious SQL payload in the affected parameter, and because publicly available exploit code exists, this can be automated at scale. The injected query dumps sensitive database contents such as WordPress user records, password hashes, and session/API secrets, which the attacker then uses for account takeover or further compromise.