Unauthenticated SQL Injection in the Locatoraid Store Locator WordPress plugin versions through 3.9.72 allows an attacker to inject arbitrary SQL statements without credentials. This flaw can lead to data exfiltration, unauthorized database modification, and, in certain configurations, the execution of arbitrary code within the database engine. The vulnerability is classified as CWE-89 and is considered a critical security weakness.

The vulnerability affects the WordPress Locatoraid Store Locator plugin released by plainware, specifically all versions up to and including 3.9.72. Any WordPress site that has this plugin installed with a vulnerable version is at risk of exploitation; sites using version 3.9.73 or newer are no longer affected.

The CVSS score of 9.3 reflects a severe risk resulting from unauthenticated access to the vulnerable interface. EPSS data is not available and the vulnerability is not listed in CISA KEV, yet the lack of authentication and the ability to inject arbitrary SQL make exploitation straightforward for a motivated attacker. The attack vector is remote; an attacker can craft malicious input and submit it directly to the plugin’s front‑end, potentially gaining full database control or remote code execution in misconfigured environments.