The highwarden Super Store Finder plugin for WordPress contains an SQL Injection vulnerability (CVE-2025-39445) due to improper neutralization of special elements used in SQL commands. This flaw affects all versions up to 7.2 and allows remote attackers to execute arbitrary SQL commands without authentication. The vulnerability is network exploitable with low attack complexity and no user interaction required. The CVSS vector indicates a critical impact on confidentiality with some impact on availability but no integrity impact. No vendor advisory or patch links are currently available.

Successful exploitation of this vulnerability could allow an attacker to access or exfiltrate sensitive database information, potentially compromising confidentiality. The vulnerability does not directly impact data integrity but may cause limited denial of service conditions. Given the critical CVSS score of 9.3, the risk to affected systems is high if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version. Monitor vendor channels for updates and apply patches promptly once released.