CVE-2026-12965: Super Store Finder SQL Injection Flaw

CVE-2026-12965 Overview

CVE-2026-12965 is an unauthenticated SQL injection vulnerability in the Super Store Finder WordPress plugin through version 7.8. The plugin fails to sanitize a parameter passed to an unauthenticated AJAX action before including it in a SQL query. Attackers can send crafted requests to the vulnerable AJAX endpoint and extract arbitrary data from the WordPress database. The flaw is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). No authentication or user interaction is required to exploit the issue.

Critical Impact
Unauthenticated network attackers can extract sensitive data, including user credentials and session tokens, from WordPress sites running Super Store Finder through 7.8.

Affected Products

Super Store Finder WordPress plugin, all versions through 7.8
WordPress sites with the plugin installed and activated
Any deployment exposing the plugin's unauthenticated AJAX endpoints

Discovery Timeline

2026-08-03 - CVE-2026-12965 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-12965

Vulnerability Analysis

The Super Store Finder plugin registers an AJAX action accessible to unauthenticated users through the standard WordPress admin-ajax.php endpoint. The handler consumes a request parameter and concatenates it directly into a SQL query without prepared statements or input sanitization. Because the endpoint is registered with wp_ajax_nopriv_, no session, nonce validation, or capability check gates the code path. Attackers can inject SQL syntax to alter the query and read arbitrary rows from the WordPress database, including the wp_users table containing password hashes and session tokens.

Successful exploitation can lead to full account takeover through offline hash cracking or reuse of authenticated session artifacts. The vulnerability aligns with classic CWE-89 patterns where user-controlled input reaches the database layer through string interpolation. See the WPScan Vulnerability Report for identifier details.

Root Cause

The plugin passes an unsanitized request parameter into a SQL statement built via string concatenation rather than using $wpdb->prepare(). WordPress provides parameterized query APIs, but the vulnerable handler bypasses them. The AJAX action is also exposed to unauthenticated visitors, expanding the attack surface to any anonymous HTTP client that can reach the site.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a POST or GET request to /wp-admin/admin-ajax.php specifying the vulnerable action and injects SQL payloads such as UNION SELECT statements into the affected parameter. The database returns attacker-selected columns in the response body or in error output, enabling data exfiltration in a single request or through blind, time-based techniques.

See the WPScan Vulnerability Report for technical details on the affected AJAX action and parameter.

Detection Methods for CVE-2026-12965

Indicators of Compromise

Unusual POST or GET requests to /wp-admin/admin-ajax.php containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA
Spikes in admin-ajax.php traffic from a single source IP or user agent lacking a valid Referer
Web server or database logs showing malformed query strings referencing Super Store Finder AJAX actions
Unexpected outbound reads from the wp_users or wp_usermeta tables in database audit logs

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting admin-ajax.php actions registered by the plugin
Enable MySQL general query log or slow query log to identify anomalous UNION-based reads originating from the WordPress user
Correlate WordPress access logs with authentication events to identify data extraction followed by credential reuse

Monitoring Recommendations

Alert on repeated 200 OK responses to admin-ajax.php where request bodies contain SQL metacharacters
Baseline typical Super Store Finder AJAX action volume and alert on statistical deviations
Monitor for outbound egress from web servers to unknown destinations following suspicious database queries

How to Mitigate CVE-2026-12965

Immediate Actions Required

Disable or uninstall the Super Store Finder plugin until a patched version is confirmed installed
Restrict access to /wp-admin/admin-ajax.php at the reverse proxy or WAF layer, allowing only known-good actions
Rotate all WordPress user passwords and invalidate active sessions if the plugin has been exposed to the internet
Audit database contents for signs of unauthorized reads or new administrator accounts

Patch Information

As of the CVE publication on 2026-08-03, no fixed version is listed in the NVD entry. Administrators should monitor the WPScan Vulnerability Report and the vendor's plugin repository page for a security release addressing the affected AJAX handler.

Workarounds

Block requests to the vulnerable AJAX action at the WAF or reverse proxy until a patched version is available
Apply virtual patching rules that reject requests containing SQL metacharacters in Super Store Finder parameters
Enforce least-privilege database credentials for the WordPress user to limit the impact of successful injection
Deactivate the plugin on sites where store finder functionality is not required

bash

# Example nginx rule to block requests targeting the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "super_store_finder") {
        return 403;
    }
}