WordPress Super Store Finder <= 7.2 - Vulnerabilidad de Inyección SQL

The SQL Injection vulnerability in Super Store Finder poses a significant risk to WordPress sites utilizing the plugin. An attacker could leverage this flaw to bypass authentication mechanisms, directly query the database, and extract sensitive information such as user credentials, customer data, order details, and potentially even database schema information. Successful exploitation could lead to complete compromise of the WordPress site and associated data. The impact is particularly severe if the database contains personally identifiable information (PII) or financial data, potentially leading to regulatory fines and reputational damage. While no specific exploitation patterns have been publicly linked to this CVE yet, SQL Injection vulnerabilities are frequently targeted, making this a high-priority concern.

WordPress websites utilizing the Super Store Finder plugin, particularly those with e-commerce functionality or handling sensitive user data, are at significant risk. Shared hosting environments where plugin updates are managed by the hosting provider may also be vulnerable if they have not yet applied the update.

• wordpress / composer / npm:

grep -r "superstorefinder-wp" /var/www/html/
wp plugin list | grep superstorefinder-wp

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/superstorefinder-wp/ | grep SQL

1. 2025-05-19Disclosure

   disclosure

1. Reservado2025-04-16
2. Publicada2025-05-19
3. Modificada2026-04-28
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-39445 is to immediately upgrade the Super Store Finder plugin to version 7.2.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting database user permissions to limit the impact of a successful injection, or implementing input validation and sanitization techniques within the plugin's code (if possible). Web Application Firewalls (WAFs) configured with rules to detect and block SQL Injection attempts can also provide an additional layer of defense. After upgrading, verify the fix by attempting a SQL Injection payload through the plugin's vulnerable endpoints and confirming that it is properly sanitized.