CVE-2026-12965 is a critical SQL injection vulnerability in the Super Store Finder WordPress plugin versions up to and including 7.8. The plugin fails to sanitize a parameter used in an unauthenticated AJAX action before incorporating it into a SQL query. This allows remote attackers to perform SQL injection attacks, potentially extracting sensitive database information without authentication. The vulnerability has a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating it is remotely exploitable over the network with low attack complexity and no privileges or user interaction required. No official patch or remediation guidance is currently provided by the vendor or in the advisory.

Successful exploitation allows unauthenticated remote attackers to perform SQL injection, leading to unauthorized disclosure and modification of sensitive database information. The vulnerability impacts confidentiality and integrity but does not affect availability. This could result in data leakage and compromise of the underlying database used by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable AJAX functionality or restricting access to it as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.