WordPress Plugin Vulnerabilities

Super Store Finder <= 7.8 - Unauthenticated SQL Injection via ssf_tracking

Description

The plugin does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.

Proof of Concept

Affects Plugins

Plugin icon
superstorefinder-wp
No known fix

References

CVE
CVE-2026-12965

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Michael Bielenberg
Submitter
Michael Bielenberg
Verified
Yes
WPVDB ID
fd13bf8a-ce99-4e2b-ba36-e899df33cf98

Timeline

Publicly Published
2026-07-24 (about 10 days ago)
Added
2026-07-24 (about 9 days ago)
Last Updated
2026-07-31 (about 2 days ago)

Other

Published
Title
Published
2025-03-24
Title
WP Multistore Locator <= 2.5.2 - Unauthenticated SQL Injection
Published
2026-07-09
Title
WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search
Published
2024-06-05
Title
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress < 1.7.3 - Authenticated (Author+) SQL Injection
Published
2024-04-25
Title
WP SMTP 1.2 - 1.2.6 - Authenticated (Admin+) SQL Injection
Published
2021-05-19
Title
FlightLog <= 3.0.2 - Authenticated (editor+) SQL Injection