The Super Store Finder WordPress plugin, in all releases up to version 7.8, fails to sanitize an input parameter delivered through an unauthenticated AJAX action before incorporating it into a SQL statement. This flaw permits attackers to inject arbitrary SQL code, enabling unauthorized read of database data, thereby compromising the confidentiality of the site’s data.

This vulnerability affects the Super Store Finder plugin for WordPress. All installed instances of the plugin with a version of 7.8 or earlier are impacted; no newer version checks are provided in the available data.

The flaw can be exploited without any authentication, by simply accessing the ssf_tracking AJAX endpoint from a remote host. Attackers can extract data from the database, exposing sensitive site information. The CVSS score is 9.1, and the EPSS score is < 1%, indicating a low probability of exploitation yet a high severity impact. The vulnerability is not listed in CISA’s KEV catalog, which suggests no known large‑scale exploitation has been reported. Nevertheless, because the attack vector is network‑based and no privilege is required, organizations should treat its potential impact as high.