EUVD-2026-52169
GHSA-hr2r-68v6-qv47
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network SQLi with no user interaction gives AV:N/AC:L/PR:N/UI:N; description cites only data extraction, so C:H but I:N and A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.
Articles & Coverage 1
AnalysisAI
SQL injection in the Super Store Finder WordPress plugin (versions through 7.8) lets unauthenticated remote attackers inject arbitrary SQL via an unsanitized parameter in an AJAX action, enabling extraction of arbitrary database contents. Reported by WPScan with publicly available exploit code, the flaw carries a 9.1 CVSS and CISA SSVC rates it automatable with total technical impact, though EPSS remains low at 0.19% and it is not in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the Super Store Finder WordPress plugin (version ≤7.8) be installed and active on the target site; the vulnerable AJAX action is registered for unauthenticated (nopriv) users, so no login, user interaction, or non-default configuration is needed (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a high-severity, network-reachable, unauthenticated, low-complexity flaw, and SSVC reinforces this by marking exploitation as poc, automatable=yes, and technical impact=total - all signals pointing to a genuine, easily weaponizable priority for any site running the plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request to the plugin's vulnerable AJAX endpoint (admin-ajax.php) with a malicious SQL payload in the affected parameter, and because publicly available exploit code exists, this can be automated at scale. The injected query dumps sensitive database contents such as WordPress user records, password hashes, and session/API secrets, which the attacker then uses for account takeover or further compromise. |
| Remediation | No fixed version is identified in the provided data - the flaw is reported as present through version 7.8 with no confirmed patched release, so this should be treated as 'No vendor-released patch identified at time of analysis'; monitor the WPScan advisory (https://wpscan.com/vulnerability/fd13bf8a-ce99-4e2b-ba36-e899df33cf98/) and the vendor's CodeCanyon/plugin changelog for an update beyond 7.8 and apply it immediately once released. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances using Super Store Finder through version 7.8 and disable the plugin if business requirements permit removal. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today