Improper neutralization of special elements in SQL commands creates a classic SQL injection flaw that allows an attacker to inject arbitrary SQL statements into queries executed by the Super Store Finder plugin. This can enable the execution of unauthorized database commands, leading to data disclosure, modification, or deletion, potentially exposing sensitive information stored in the WordPress database.

The vulnerability affects the WordPress Super Store Finder plugin from all releases without a version number through version 7.5. Any site running highwarden’s Super Store Finder plugin in these versions is susceptible; upgrading beyond 7.5 removes the flaw.

The CVSS score of 9.3 indicates critical severity, and although the EPSS score is below 1% and it is not listed in the CISA KEV catalog, the flaw remains highly exploitable in practice. The likely attack vector is through a maliciously crafted request to the plugin’s input fields, which can be accessed by authenticated or unauthenticated users depending on the site’s configuration. Successful exploitation would grant the attacker the power to read, modify, or delete database contents associated with the WordPress installation.