CVE-2026-66680: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in plainware Locatoraid Store Locator

This vulnerability (CVE-2026-66680) involves improper neutralization of special elements used in SQL commands (CWE-89) in Locatoraid Store Locator versions up to 3.9.72. It allows unauthenticated attackers to perform SQL Injection attacks remotely, which can compromise the confidentiality of the database and cause partial denial of service. The CVSS v3.1 score is 9.3 (critical), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and scope changed. The impact is high confidentiality loss and low availability loss, with no integrity impact. There is no vendor advisory or patch information available in the provided data.

The vulnerability enables unauthenticated remote attackers to inject SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). There is no indication of integrity compromise. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting Locatoraid Store Locator. Avoid exposing the vulnerable application to untrusted networks if possible.