CVE-2026-12965 — Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking

CVE-2026-12965

Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking PUBLISHED

Description (CNA)

The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.

Affected (CNA)

Vendor / product	Versions
Unknown / Super Store Finder WordPress	affected 0 before 7.11

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fd13bf8a-ce99-4e2b-ba36-e899df33cf98/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.