CVE-2026-73392 CRITICAL

CVE-2026-73392: WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability

Vendor Highwarden

Product Super Store Finder

Weakness CWE-89 · SQLi

Published August 18, 2026

Last update August 18, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Super Store Finder versions 7.8 and earlier contain a SQL injection vulnerability in an unspecified component. An attacker can craft malicious input to execute arbitrary SQL queries against the database, potentially reading or modifying sensitive data. No authentication is required. The vulnerability also impacts system availability.

What an attacker can do

03Attacker Capabilities

Execute SQL queries to read or modify database contents without authentication.

Potential impact on your site

04Site Impact

Attackers can access sensitive data, modify records, or degrade database performance without logging in.

Conditions required to exploit

05Prerequisites

Network access to the affected application; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 18, 2026 CVE published

August 18, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-73392 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities