External risk intelligence

Super Store Finder WordPress Plugin SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-12965

This is a vulnerability in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications. Because the vulnerability affects an unauthenticated AJAX action, it is reachable by any user accessing the website over the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Super Store Finder WordPress plugin that allows unauthenticated attackers to inject SQL queries. This could enable them to extract sensitive data from your websites' databases. The main concern is confirming the relevance and exposure of this plugin across your digital footprint.

Unauthenticated database data theft risk.
Critical plugin flaw for public websites.
Confirm plugin use; assess data exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the website. This request would target an unauthenticated AJAX action within the Super Store Finder plugin. Because the plugin does not properly clean a parameter in this action, an attacker can inject malicious SQL code, potentially leading to the theft of sensitive information from the site's database.

Unauthenticated access to the website.
Triggering an AJAX action with a malicious parameter.
SQL injection to extract database data.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated SQL injection vulnerability in the Super Store Finder WordPress plugin could allow attackers to extract sensitive data from the site's database. This occurs because a parameter in an AJAX action is not properly sanitized before being used in a SQL query.

Database data could be compromised.
Attackers can inject SQL queries.
Sensitive information may be exposed.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Super Store Finder WordPress plugin's SQL injection vulnerability requires immediate attention from teams managing WordPress instances. The first step is to inventory all WordPress deployments, confirm the plugin's presence and version, assess its exposure and criticality, and identify the accountable application or infrastructure owner. This information will inform a risk-based remediation plan, potentially involving vendor coordination or temporary mitigation if direct patching is not immediately feasible.

WordPress administrators own this issue.
Verify plugin presence and exposure.
Plan targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Super Store Finder WordPress plugin?

Super Store Finder is a specialized plugin for WordPress websites designed to help visitors locate physical business branches or retail points on an interactive map. It acts as an add-on to the core WordPress platform, providing directory management and geocoding features that store owners use to improve customer navigation and increase foot traffic to their physical locations.

What does SQL injection mean for CVE-2026-12965?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, the plugin fails to check incoming data for malicious code. Because it allows untrusted input to interact directly with the database, an attacker can manipulate the plugin's search queries to trick the database into revealing sensitive information it was never intended to share.

How is the SQL injection triggered?

An attacker triggers this by sending a specially crafted request to an AJAX action provided by the plugin. Because this specific action is designed to be unauthenticated, no login or account permissions are required to reach the vulnerable code. Simply visiting the site or interacting with a page that utilizes the plugin's map search functionality can potentially facilitate this attack if the malicious parameter is included in the request.

Is my website at risk from this vulnerability?

If you use this plugin, your risk depends on your site's availability. According to Halo Surface Signal, this plugin is commonly deployed on public-facing web applications. Since the flaw exists in an unauthenticated component, any site reachable over the public internet is considered exposed. Internal-only sites that are not accessible to external traffic face a significantly reduced risk compared to public-facing instances.

Do I need to take action if I use this plugin?

Yes, you should prioritize this issue. Start by auditing your WordPress environment to confirm if the Super Store Finder plugin is installed and if you are using version 7.8 or earlier. Once identified, locate the owner of the application to coordinate a risk assessment. You should investigate if a vendor update is available or if you need to temporarily disable the plugin until a secure version is deployed to protect your database.

References

wpscan.com/vulnerability/fd13bf8a-ce99-4e2b-ba36-e899df33cf98/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.