CVE-2026-12965
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Super Store Finder WordPress plugin through version 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection and extract data from the database.
Risk Assessment
An attacker can extract sensitive data from the database, including user data and passwords, leading to security and privacy breaches.
Recommendation
Update the Super Store Finder plugin to a version above 7.8 or apply a patch that sanitizes parameters before use in SQL queries.
Original NVD description (English source)
The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.