CVE-2026-12965 - Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking

Back Back to CVE browser

CRITICAL

Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking

Published Aug 3, 2026

9.1

CRITICAL

CVSS 3.1

EPSS 0.46%

Description

The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.

Affected products

Vendor n/a Product Super Store Finder WordPress Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <7.11

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Super Store Finder WordPress

unaffected

Version	Status	Constraints
0	affected	<7.11

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52169
Advisory
https://wpscan.com/vulnerability/fd13bf8a-ce99-4e2b-ba36-e899df33cf98/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52169		Advisory
https://wpscan.com/vulnerability/fd13bf8a-ce99-4e2b-ba36-e899df33cf98/		exploitvdb-entrytechnical-description