What is the CVSS score of CVE-2026-73392?

CVE-2026-73392 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Super Store Finder are affected by CVE-2026-73392?

The Super Store Finder WordPress plugin (versions 7.8 and earlier) contains a critical unauthenticated SQL injection vulnerability allowing remote attackers to extract your WordPress database…

How to fix or mitigate CVE-2026-73392?

Within 24 hours, inventory all WordPress installations using Super Store Finder plugin versions 7.8 or earlier and immediately disable the plugin in production; implement Web Application Firewall (WAF) rules to block HTTP requests matching SQL injection patterns to the plugin's vulnerable paths as a temporary measure if disabling is operationally infeasible. Within 7 days, conduct forensic review of WordPress access logs and database query logs to identify any exploitation attempts and coordinate with your hosting provider to audit for unauthorized database access patterns. Within 30 days, deploy an alternative store-locator plugin from an actively maintained vendor, establish continuous monitoring for vendor security advisories regarding this CVE, and prepare for immediate production deployment of any patch once the vendor releases a fix.

Super Store Finder CVE-2026-73392

EUVD-2026-60799 CRITICAL

SQL Injection (CWE-89)

2026-08-18 Patchstack

GHSA-j7f2-9vv7-mwp8

SQLi Super Store Finder

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable SQLi gives AV:N/AC:L/PR:N/UI:N with C:H for database disclosure; scope is unchanged (S:U) and read-oriented injection implies no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 14:55 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions.

AnalysisAI

Unauthenticated SQL injection in the Super Store Finder WordPress plugin (versions 7.8 and earlier, vendor 'highwarden'/superstorefinder-wp) lets remote attackers inject arbitrary SQL through unsanitized input reachable without authentication. The CVSS 3.1 base score is 9.3 and the flaw was catalogued by Patchstack under CWE-89; no public exploit code and no active-exploitation listing were identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running Super Store Finder <=7.8

Delivery

Send crafted request to unauthenticated search endpoint

Exploit

Inject SQL via location parameter

Execution

Query executes against WordPress database

Impact

Exfiltrate user credentials and site data

Access

Identify WordPress site running Super Store Finder <=7.8

Delivery

Send crafted request to unauthenticated search endpoint

Exploit

Inject SQL via location parameter

Execution

Query executes against WordPress database

Impact

Exfiltrate user credentials and site data

Vulnerability AssessmentAI

Exploitation	Exploitation requires only that a WordPress site have the Super Store Finder plugin (version 7.8 or earlier) installed and its store-search/location-lookup functionality network-reachable; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low attack complexity, so default installations of the vulnerable versions are exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals point to a genuinely high-priority issue but with important caveats. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crawls the internet for WordPress sites running Super Store Finder, then sends a crafted request to the plugin's location-search endpoint containing a malicious SQL payload in a lookup parameter. Because no authentication is required, the injected query executes against the site database and the attacker exfiltrates administrator usernames and password hashes for offline cracking or further account takeover. …
Remediation	Upgrade the Super Store Finder plugin to a release later than 7.8 as soon as the vendor publishes one; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-plugin-7-8-sql-injection-vulnerability?_s_id=cve) for the fixed version, since an exact patched build was not included in the source data. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress installations using Super Store Finder plugin versions 7.8 or earlier and immediately disable the plugin in production; implement Web Application Firewall (WAF) rules to block HTTP requests matching SQL injection patterns to the plugin's vulnerable paths as a temporary measure if disabling is operationally infeasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.