EUVD-2026-52169
GHSA-hr2r-68v6-qv47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Super Store Finder
-
DeliverySend crafted AJAX request to admin-ajax.php
-
ExploitInject SQL via unsanitized parameter
-
ExecutionExtract user credentials and secrets
-
ImpactEscalate to account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the Super Store Finder WordPress plugin (version ≤7.8) be installed and active on the target site; the vulnerable AJAX action is registered for unauthenticated (nopriv) users, so no login, user interaction, or non-default configuration is needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is deployment scope - the site must actually run this specific plugin - rather than any authentication or platform constraint; the injectable request parameter must be reachable via the plugin's public AJAX handler. No special feature toggle is indicated by the description as a prerequisite. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a high-severity, network-reachable, unauthenticated, low-complexity flaw, and SSVC reinforces this by marking exploitation as poc, automatable=yes, and technical impact=total - all signals pointing to a genuine, easily weaponizable priority for any site running the plugin. Counterbalancing this, the EPSS score is only 0.19% (9th percentile) and the CVE is NOT in CISA KEV, indicating no evidence of widespread or active exploitation yet; the low EPSS likely reflects the plugin's limited deployment footprint rather than any difficulty of exploitation. Note a minor conflict worth verifying: the description states only that attackers can 'extract data' (a confidentiality/read impact), yet the published CVSS assigns I:H - the integrity-high rating is not clearly supported by the description and should be confirmed against the WPScan advisory. Overall this is a real, exploit-available issue that should be patched promptly on affected sites, but the absence of KEV/high-EPSS suggests opportunistic rather than mass-scanning exploitation to date. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the plugin's vulnerable AJAX endpoint (admin-ajax.php) with a malicious SQL payload in the affected parameter, and because publicly available exploit code exists, this can be automated at scale. The injected query dumps sensitive database contents such as WordPress user records, password hashes, and session/API secrets, which the attacker then uses for account takeover or further compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
SQL injection in the Super Store Finder WordPress plugin (versions through 7.8) lets unauthenticated remote attackers inject arbitrary SQL via an unsanitized parameter in an AJAX action, enabling extraction of arbitrary database contents. Reported by WPScan with publicly available exploit code, the flaw carries a 9.1 CVSS and CISA SSVC rates it automatable with total technical impact, though EPSS remains low at 0.19% and it is not in CISA KEV. There is no public exploit identified as being used in active campaigns at time of analysis.
RemediationAI
No fixed version is identified in the provided data - the flaw is reported as present through version 7.8 with no confirmed patched release, so this should be treated as 'No vendor-released patch identified at time of analysis'; monitor the WPScan advisory (https://wpscan.com/vulnerability/fd13bf8a-ce99-4e2b-ba36-e899df33cf98/) and the vendor's CodeCanyon/plugin changelog for an update beyond 7.8 and apply it immediately once released. Until a patch exists, the most effective compensating control is to deactivate and remove the Super Store Finder plugin, which fully eliminates exposure at the cost of losing store-locator functionality on the site. If removal is not acceptable, deploy a WAF rule (e.g., via Wordfence, Cloudflare, or ModSecurity) to filter SQL metacharacters on the plugin's admin-ajax.php action and restrict or rate-limit access to admin-ajax.php from untrusted sources - with the trade-off that WAF signatures can be bypassed and may block legitimate AJAX calls, so test rules before enforcing. Ensure database credentials used by WordPress have least-privilege (read-only where feasible for the plugin's queries) to limit blast radius.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Super Store Finder, a commercial WordPress store-locator plugin, exposed here through the WordPress admin-ajax.php AJAX handler mechanism. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a request parameter is concatenated into a SQL query without sanitization or prepared statements. Because the AJAX action is registered for unauthenticated (nopriv) users, the injection point is reachable without any login, and WordPress's underlying database (typically MySQL/MariaDB via wpdb) is queried directly. The CPE (cpe:2.3:a:unknown:super_store_finder_wordpress) confirms the plugin as the sole affected product; the vendor is listed as unknown in the CPE dictionary.
Know when Super Store Finder Wordpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network SQLi with no user interaction gives AV:N/AC:L/PR:N/UI:N; description cites only data extraction, so C:H but I:N and A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.
Articles & Coverage 1
Executive ViewAI
The Super Store Finder WordPress plugin (versions through 7.8) contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to extract the entire WordPress database without any authentication. Organizations running this plugin face immediate risk of complete database compromise, including customer data, credentials, and configuration details.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the vulnerable AJAX endpoint via web server rules or .htaccess; deploy Web Application Firewall signatures to block SQL injection payloads; restrict WordPress database user permissions to minimum necessary (read-only access where possible); implement parameterized query enforcement if plugin code is accessible; isolate affected WordPress instances on a restricted network segment; or completely remove the plugin and migrate storefront functionality to an alternative solution. Monitor for patch announcements from the plugin vendor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB