CVE-2025-52720CWE-89

WordPress Super Store Finder Plugin <= 7.5 - SQL Injection Vulnerability

Critical · published August 14, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

🚨 A tiny flaw in Super Store Finder could turn into a data disaster! SQL injection means an attacker can manipulate queries and access your database without breaking a sweat. 🔥 Think of it like a restaurant menu that lets customers write in their own orders. If no one checks the kitchen's input, a customer could ask for a secret recipe instead of the usual salad! This SQL injection vulnerability allows an attacker to gain full control of the database, potentially exposing sensitive data, tampering with records, or even deleting everything. It's an open door to chaos, making your entire system vulnerable to exploitation!

Put simply

Think of it like a restaurant menu that lets customers write in their own orders. If no one checks the kitchen's input, a customer could ask for a secret recipe instead of the usual salad! The vulnerability arises from improper neutralization of special SQL elements in user-supplied input, allowing malicious SQL commands to be executed in the database. This could lead to unauthorized data access and manipulation.

What to do

This SQL injection vulnerability allows an attacker to gain full control of the database, potentially exposing sensitive data, tampering with records, or even deleting everything. It's an open door to chaos, making your entire system vulnerable to exploitation! Immediately patch your Super Store Finder to version 7.5 or later to close this security gap. Regularly audit your input validation mechanisms to ensure they properly sanitize user input. Enable monitoring to detect any unusual database queries going forward. You've got this! Follow these steps and you'll have your system secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-08-14T10:34Z
EPSS history
Timeline
  • 14 AUG 10:34Z
    WordPress Super Store Finder Plugin <= 7.5 - SQL Injection Vulnerability
    cvelistv5