Super Store Finder Wordpress
Monthly
SQL injection in the Super Store Finder WordPress plugin (versions through 7.8) lets unauthenticated remote attackers inject arbitrary SQL via an unsanitized parameter in an AJAX action, enabling extraction of arbitrary database contents. Reported by WPScan with publicly available exploit code, the flaw carries a 9.1 CVSS and CISA SSVC rates it automatable with total technical impact, though EPSS remains low at 0.19% and it is not in CISA KEV. There is no public exploit identified as being used in active campaigns at time of analysis.
SQL injection in the Super Store Finder WordPress plugin (versions through 7.8) lets unauthenticated remote attackers inject arbitrary SQL via an unsanitized parameter in an AJAX action, enabling extraction of arbitrary database contents. Reported by WPScan with publicly available exploit code, the flaw carries a 9.1 CVSS and CISA SSVC rates it automatable with total technical impact, though EPSS remains low at 0.19% and it is not in CISA KEV. There is no public exploit identified as being used in active campaigns at time of analysis.