PatchSiren cyber security CVE debrief

CVE-2026-12965 Super Store Finder CVE debrief

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database. This vulnerability has a significant impact on the security of WordPress installations using the Super Store Finder plugin. Affected users should verify the vulnerability exists and apply patches or updates as needed. The CVE record was published on 2026-08-03T07:16:39.190Z and has not been modified since then. The evidence for this vulnerability is limited, and defenders should exercise caution when assessing the impact on their environments.

Vendor: Super Store Finder
Product: Super Store Finder WordPress plugin
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-03
Original CVE updated: 2026-08-03
Advisory published: 2026-08-03
Advisory updated: 2026-08-03

Who should care

Users of the Super Store Finder WordPress plugin version 7.8 or earlier should verify the vulnerability exists and apply patches or updates as needed. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact of this vulnerability on their environments.

Technical summary

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database. This vulnerability affects WordPress installations using the Super Store Finder plugin version 7.8 or earlier. Users of the plugin should verify the vulnerability exists and apply patches or updates as needed. The vulnerability allows unauthenticated attackers to perform SQL injection and extract data from the database, which can lead to unauthorized access to sensitive information.

Defensive priority

Low priority, limited information available

Recommended defensive actions

Verify the vulnerability exists in the Super Store Finder WordPress plugin version 7.8 or earlier
Check for any available patches or updates from the vendor
Review compensating controls for exposed systems while remediation is scheduled and verified
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence for CVE-2026-12965 is limited. The CVE record was published on 2026-08-03T07:16:39.190Z and has not been modified since then. The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database. Defenders should verify the vulnerability exists in the Super Store Finder WordPress plugin version 7.8 or earlier and track inventory for affected systems.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-03T07:16:39.190Z and has not been modified since then.