External risk intelligence

Locatoraid Store Locator SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-66680

The vulnerability affects a WordPress plugin designed for store locator functionality. Such plugins are intended to be accessed by public users on websites, making the vulnerable endpoints commonly internet-facing as part of standard web application deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security flaw in a popular store locator tool, which could allow unauthorized access to sensitive information. The vulnerability is unauthenticated, meaning an attacker does not need special privileges to exploit it, and it affects network-accessible components. The main concern is confirming relevance and exposure to your business operations.

Unauthenticated access to sensitive data.
Affects widely used store locator tools.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending specially crafted requests to a vulnerable web application that utilizes the affected plugin. This could lead to unauthorized access to sensitive data within the application's database.

Requires no user interaction.
Triggered by unauthenticated SQL injection.
Risk of unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code into the Locatoraid Store Locator plugin. When supported by the advisory's context, this could lead to unauthorized access or manipulation of the application's database, potentially exposing sensitive information.

Database data could be affected.
Injection may occur via network requests.
Unauthorized data access is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Unauthenticated SQL injection in the Locatoraid Store Locator plugin presents a critical risk. Determining where this plugin is deployed, whether it's exposed externally, and its business criticality are the first steps. Accountability will likely fall to the website or application owner, in coordination with infrastructure or platform teams responsible for the hosting environment.

Website owners and platform teams own this issue.
Verify external exposure and business criticality.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Locatoraid Store Locator plugin?

Locatoraid is a WordPress plugin that adds store locator functionality to websites. It allows visitors to search for physical business locations, view maps, and see store details directly on the site, making it a functional component for retail or service-oriented web pages.

What does CVE-2026-66680 mean by SQL injection?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. Essentially, the plugin fails to properly filter input from a user. An attacker can submit specially crafted data that the plugin mistakenly processes as a database command, potentially allowing them to bypass security controls and retrieve data they should not have access to.

How is this SQL injection vulnerability triggered?

The flaw is triggered when an attacker sends a malicious web request directly to the vulnerable plugin endpoint. Crucially, the attacker does not need to have an account, be logged in, or interact with any specific user to initiate this. It is a direct network-based attack against the plugin's data-processing logic.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this plugin is designed to be publicly accessible to provide search functions to site visitors. Because the plugin is intended to face the internet, any website running version 3.9.72 or earlier is considered to have externally accessible entry points, increasing the likelihood that this vulnerability is reachable by external actors.

What should I do to secure my environment?

Start by identifying all websites within your organization that have the Locatoraid plugin installed. Determine the specific version in use, verify if the plugin is exposed to the internet, and assess the sensitivity of the data stored in the associated database. Coordinate with your web or platform teams to plan for a secure update.

References

patchstack.com/database/wordpress/plugin/locatoraid/vulnerability/wo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.