A critical SQL injection vulnerability in the Super Store Finder WordPress plugin allows unauthenticated attackers to exfiltrate sensitive data from the underlying database.

The plugin fails to sanitize user-supplied parameters within an unauthenticated AJAX action before incorporating them into SQL queries. This allows unauthenticated attackers to manipulate query structures to bypass security controls and retrieve unauthorized information from the database.

With a CVSS score of 9.1, this vulnerability poses a significant threat to data privacy and regulatory compliance. Exploitation allows attackers to read, modify, or delete database content, which could lead to the exposure of customer information, administrative credentials, or other sensitive business data.

Immediate Action: Update the Super Store Finder plugin to a version greater than 7.8 immediately. If patching is not feasible, restrict access to the affected AJAX endpoints at the server or WAF level.

Proactive Monitoring: Review database query logs for anomalous patterns or injection-style syntax often associated with SQL exploitation attempts.

Compensating Controls: Implement a WAF to filter malicious SQL injection payloads from incoming HTTP requests before they reach the application layer.

Public Exploit Available: Yes (per public proof-of-concept availability)

Given the availability of a proof-of-concept and the critical nature of the data typically stored in store finder databases, prompt remediation is essential. Organizations should update the plugin immediately to prevent unauthorized access to their database infrastructure.