CVE-2026-66680

CriticalCVSS 9.3

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Unauthenticated SQL Injection vulnerability in the Locatoraid Store Locator plugin. Affects versions up to 3.9.72.

An unauthenticated attacker can inject SQL queries, potentially leading to data leakage, database modification, or admin account takeover.

Immediately update the Locatoraid Store Locator plugin to a version that fixes this vulnerability.

Original NVD description (English source)

Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.