CVE-2026-108541
MediumCVSS 6.3Summary
A vulnerability was found in highwarden Super Store Finder up to version 3.8. An unknown function in /products/superstorefinder/index.php is affected, and manipulation of the lat/lng arguments leads to SQL injection. Remote exploitation is possible, and the exploit has been publicly disclosed. Upgrading to version 3.9 addresses the issue.
Risk Assessment
The risk includes unauthorized database access, data leakage, and potential application compromise. The publicly available exploit increases the likelihood of attack.
Recommendation
Upgrade Super Store Finder to version 3.9 or later immediately. After upgrading, scan the application for signs of exploitation.
Other vulnerabilities in Super Store Finder
See all- CVE-2026-81768High
An unauthenticated Cross Site Scripting (XSS) vulnerability in Super Store Finder versions up to and including 7.10.
- CVE-2025-58939Medium
The Super Store Finder plugin for WordPress (versions up to 7.5) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions.
Original NVD description (English source)
A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS