CVE-2026-73392: Super Store Finder SQLi Vulnerability

CVE-2026-73392 Overview

CVE-2026-73392 is an unauthenticated SQL injection vulnerability affecting the Super Store Finder WordPress plugin in versions 7.8 and earlier. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Remote attackers can inject arbitrary SQL statements without authentication, enabling database interaction through crafted HTTP requests. The vulnerability was published to the National Vulnerability Database (NVD) on August 18, 2026, and cataloged by Patchstack in its WordPress vulnerability database.

Critical Impact
Unauthenticated attackers can inject SQL statements over the network to extract sensitive data from the WordPress database or degrade site availability.

Affected Products

Super Store Finder WordPress plugin (superstorefinder-wp) version 7.8
All prior versions of the Super Store Finder plugin
WordPress installations running the vulnerable plugin

Discovery Timeline

2026-08-18 - CVE-2026-73392 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73392

Vulnerability Analysis

The vulnerability resides in the Super Store Finder WordPress plugin, which provides store locator functionality for WordPress sites. The plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries. Attackers submit crafted parameters through HTTP requests to reach the database layer without prior authentication. The scope change indicated by the CVSS vector shows that successful exploitation affects resources beyond the vulnerable component itself.

Successful exploitation grants read access to WordPress database contents, including user records, session tokens, and configuration data stored in wp_options. Attackers can enumerate table structures, extract password hashes, and identify additional attack surface within the target environment. The confidentiality impact is high while the integrity impact is not present according to the CVSS vector.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin concatenates untrusted request parameters into SQL statements without using parameterized queries or the WordPress $wpdb->prepare() API. Missing input validation allows metacharacters such as single quotes, UNION keywords, and comment sequences to alter query semantics.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to a vulnerable endpoint exposed by the plugin with a malicious payload embedded in a request parameter. The injected SQL executes with the privileges of the WordPress database user, typically granting access to every table in the site's schema. Boolean-based, time-based, and UNION-based injection techniques are all viable against classic SQL injection flaws of this class. Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-73392

Indicators of Compromise

Unusual HTTP requests targeting Super Store Finder plugin endpoints containing SQL metacharacters such as ', UNION SELECT, SLEEP(, or --
Web server log entries showing repeated 500-series errors originating from plugin URLs under /wp-content/plugins/superstorefinder-wp/
Outbound database queries with anomalous durations consistent with time-based blind SQL injection
Unexpected reads against wp_users, wp_usermeta, or wp_options tables from web application accounts

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings and POST bodies for SQL injection patterns targeting plugin endpoints
Monitor WordPress access logs for requests to Super Store Finder AJAX handlers containing encoded SQL syntax
Correlate authentication failures, error responses, and database latency spikes with requests to the plugin's routes

Monitoring Recommendations

Enable database query logging on the MySQL or MariaDB backend to capture injected statements for forensic review
Alert on newly created administrative users or modifications to WordPress options that follow suspicious plugin traffic
Track the WordPress plugin inventory across managed sites and flag installations of superstorefinder-wp at version 7.8 or earlier

How to Mitigate CVE-2026-73392

Immediate Actions Required

Update the Super Store Finder plugin to a version above 7.8 as soon as the vendor publishes a fixed release
Restrict access to WordPress admin and plugin routes through IP allowlists or authenticated reverse proxies where feasible
Rotate WordPress database credentials, administrative passwords, and API keys if exploitation is suspected
Review the WordPress user table for unauthorized accounts created after August 18, 2026

Patch Information

Refer to the Patchstack advisory for Super Store Finder for current patch availability. As of the last NVD update on August 20, 2026, no vendor advisory URL is listed in the CVE record. Administrators should track the plugin's WordPress.org listing for a release above version 7.8.

Workarounds

Deactivate and remove the Super Store Finder plugin until a patched version is released
Deploy a virtual patch through Patchstack, Wordfence, or an equivalent WAF to block SQL injection payloads targeting plugin endpoints
Apply least-privilege principles to the WordPress database account to limit the damage from successful injection

bash

# Example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate superstorefinder-wp
wp plugin delete superstorefinder-wp