CVE-2026-12965: Critical SQL Injection in Super Store Finder for WordPress

Published on 5 August 2026

Anyone embedding a store or dealer map on their WordPress website via the "Super Store Finder" plugin currently has a serious problem: All versions up to and including 7.8 contain a critical security vulnerability that allows attackers to read your website's entire database without any authentication whatsoever – including usernames, email addresses, hashed passwords and customer data. The vulnerability carries the identifier CVE-2026-12965 and has been rated with a CVSS score of 9.1 out of 10. And worst of all: there is no official patch from the vendor so far.

In this article, we explain exactly what happened, whether you are affected, how to check this in just a few minutes – and which steps you should take immediately right now, also with a view to the GDPR.

What happened?

On 3 August 2026, a critical security vulnerability was made public in the WordPress plugin Super Store Finder (plugin identifier: superstorefinder-wp). It is a commercial store-locator plugin that integrates Google Maps and allows website operators to display store or dealer maps on their WordPress site – for example, a map showing all of a company's locations.

The vulnerability was discovered on 24 July 2026 by security researcher Michael Bielenberg, who reported it to WPScan – the vulnerability database of Automattic's WordPress security team. It was published on 3 August 2026 simultaneously in several authoritative databases: at WPScan, in the NVD (the National Vulnerability Database of the US-based NIST), in MITRE's CVE registry, in the European vulnerability database of ENISA (EUVD-2026-52169) as well as in the GitHub Advisory Database (GHSA-hr2r-68v6-qv47).

WPScan's description sums up the problem:

„The plugin does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database. No known fix.“ – WPScan

In plain terms: the plugin does not clean a particular input value before it is used in a database query. As a result, unauthenticated attackers can carry out a so-called SQL injection and extract data from the database. No patch is known.

Technical background – explained clearly

To put the risk into perspective, a brief look at the technology helps. Don't worry – we'll keep it simple.

An SQL injection is an attack technique in which an attacker injects their own database commands via an input field or a web parameter. Normally, a website should "sanitize" user input, i.e. remove dangerous special characters or render them harmless. This is exactly what Super Store Finder fails to do.

Specifically, the problem lies in the parameter ssf_tracking, which is passed via a so-called AJAX action. AJAX is a technique that allows a website to exchange data with the server in the background without reloading the page. WordPress provides the file admin-ajax.php for this purpose – and this is also reachable by unauthenticated visitors. The value of ssf_tracking is built directly into an SQL database query without any checking whatsoever.

The result: an attacker needs no user account, no password and no prior knowledge at all. A simple, automatable HTTP request is enough to execute arbitrary database commands. Technically, this is classified under CWE-89 ("Improper Neutralization of Special Elements used in an SQL Command") – the standard identifier for SQL injection vulnerabilities.

The official CVSS vector reads AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Translated, this means:

• AV:N (Network): The attack can be carried out remotely over the internet.
• AC:L (Low): The attack is technically simple to carry out.
• PR:N (None): No access rights whatsoever are required.
• UI:N (None): No interaction from a user is required.
• C:H / I:H: The confidentiality and integrity of the data are highly at risk – data can be read out and possibly also altered.

ENISA and the GitHub Advisory Database rate the flaw at 9.1 (Critical). WPScan itself cites 8.6 (High), which is due to a differently assessed scope parameter – this does not change the critical overall picture.

Who is affected?

Affected are all WordPress installations on which the plugin Super Store Finder version 7.8 or lower is installed. Since no patch exists so far, quite simply every installed version is considered vulnerable.

According to Wordfence Intelligence, the plugin was in use worldwide with around 6,992 active installations in April 2025. The platform sitestatsdb.com identifies at least 130 publicly verifiable websites using the plugin in July/August 2026. Notable: the plugin is no longer listed in the official WordPress.org repository – a warning sign, because it is unclear whether and when the vendor will even deliver a patch at all.

Particularly concerning is the plugin's history. Since 2020, a total of 12 vulnerabilities have been documented, including at least five unauthenticated SQL injections – among them CVE-2024-43978 with the maximum CVSS score of 10.0. This points to systematic security deficiencies in the development.

How to check whether you are affected

You can determine whether your website is at risk in just a few minutes:

1. Log into the WordPress admin area (your-website.com/wp-admin) and go to Plugins > Installed Plugins.
2. Search the list for "Super Store Finder". If it is present, check the displayed version number.
3. If the version is 7.8 or lower, your installation is affected. Since no patch is known, every version is considered vulnerable.
4. Alternatively, you can open the file wp-content/plugins/superstorefinder-wp/readme.txt via FTP/SFTP or your host's file manager and read the version there under "Stable tag".
5. A security scanner such as the Wordfence plugin or the WPScan CLI (wpscan --url https://your-website.com --enumerate p) automatically finds known vulnerabilities in installed plugins.
6. Check your server access logs (access.log) for unusual POST requests to /wp-admin/admin-ajax.php, especially in connection with the parameter ssf_tracking or SQL special characters such as ', --, UNION or SELECT.
7. Unsure whether the plugin is active? Check whether your website has a store finder or store-locator map – that is the typical usage scenario.

What you need to do now

Since no patch is available, there is only one truly safe measure: remove the plugin. Proceed as follows:

1. Immediate measure – deactivate: Deactivate "Super Store Finder" immediately under Plugins > Installed Plugins > Deactivate.
2. Delete completely: Uninstall the plugin ("Delete") to completely eliminate the attack surface.
3. Deploy a Web Application Firewall (WAF): Install a WordPress firewall such as Wordfence (free version available) or Patchstack. These detect and block SQL injection attempts. A WAF is a protective layer that filters malicious requests before they reach your website.
4. Check the database: Inspect the WordPress user table (wp_users) for unknown administrator accounts and the database for unusual entries.
5. Change passwords: As a precaution, change all administrator passwords as well as the database password.
6. Create a backup: Make a complete backup (files + database) before making major changes.
7. Enable automatic updates: Turn on auto-updates for all plugins so that future patches take effect immediately.
8. Evaluate an alternative: If you absolutely need a store finder, consider an actively maintained alternative plugin such as WP Store Locator (over 50,000 installations).
9. Subscribe to a security newsletter: Services such as WPScan, Wordfence or Patchstack automatically inform you about new vulnerabilities in your plugins.
10. Document everything: Record all measures in writing – this is important for your GDPR accountability obligation.

Context: why this is not a marginal problem

The figures speak a clear language. According to Patchstack, over 11,334 new vulnerabilities were discovered in the WordPress ecosystem in 2025 – an increase of 42% compared to the previous year. 91% of these were in plugins. And another alarming figure: 46% of the vulnerabilities received no patch by the time of publication – exactly as in the present case.

The EPSS score for CVE-2026-12965 – a measure of the probability of exploitation within the next 30 days – currently stands at just 0.19%. That sounds reassuring, but it is deceptive. Because Patchstack points out that the median time until mass exploitation of critical WordPress vulnerabilities is only five hours. Public exploit code is not yet available – WPScan intends to publish it only after a fix – but experience shows that unauthenticated SQL injections are exploited automatically within hours to days.

In 2024 alone, Wordfence blocked over 1.1 billion SQL injection attack attempts on WordPress websites. SQL injection was thus the second most frequently blocked type of attack.

GDPR: why acting now is mandatory

For German SMEs, this vulnerability has particular explosiveness. If an SQL injection succeeds, all personal data can be extracted from the WordPress database – usernames, email addresses, hashed passwords, customer data, order histories and contact form entries. This is a "personal data breach" within the meaning of Art. 4 No. 12 GDPR.

Nick Paliughi of FreshySites describes the practical consequences as follows:

„An unauthenticated SQL injection that permits data extraction could expose internal information such as user records, customer data, or other sensitive entries stored in the database. […] which raises the risk of targeted phishing or social engineering against staff or customers.“

Should such a data breach occur, the reporting obligation under Art. 33 GDPR applies: as soon as you become aware, you must report the incident without undue delay and, where possible, within 72 hours to your competent state data protection authority. If there is likely to be a high risk to those affected, you must additionally inform them yourself under Art. 34 GDPR.

Especially important: merely operating a plugin with a known, unpatched vulnerability can already be considered a violation of Art. 32 GDPR (security of processing / state of the art) – even without an actual attack having taken place. In a comparable case, the Lower Saxony data protection authority imposed a fine of 65,500 euros against an online shop that used outdated software with known SQL injection risks. The maximum fine framework of the GDPR extends up to 10 million euros or 2% of global annual turnover (Art. 83 (4)) and, in more serious cases, up to 20 million euros or 4% (Art. 83 (5)).

Conclusion

CVE-2026-12965 is a critical vulnerability with a maximum level of threat potential: exploitable remotely, without authentication, technically simple – and without an available patch. Anyone using the Super Store Finder plugin in version 7.8 or older should not wait for the vendor to react. Given the fact that the plugin has already disappeared from the official WordPress repository and has a long history of similar flaws, a patch is by no means guaranteed.

Our clear recommendation: deactivate and uninstall the plugin today. Check your database and logs for signs of exploitation, change your passwords as a precaution, and deploy a Web Application Firewall. If you need a store finder, switch to an actively maintained alternative plugin. And document all steps – this way you not only protect your data but also fulfil your obligations under the GDPR.

If you are unsure whether your website is affected or has already been compromised, seek expert support. With a critical security vulnerability like this, every hour counts.