CVE-2024-11267 — Critical SQL Injection (CVSS 8.8)

Seckhmet • April 17, 2026

A high-severity SQL Injection (CVSS 8.8) was discovered in the WordPress plugin JSP Store Locator . This vulnerability is particularly dangerous because it is exploitable with low user privileges (PR:L) , without victim interaction, and results in a triple critical impact on confidentiality, integrity and availability .

Any registered user on a WordPress site using this plugin can potentially read, modify or delete all data in the database, or even take the site offline.

Immediately update or uninstall the JSP Store Locator plugin. Check database logs for any past exploitation. Deploy a continuous WordPress monitoring solution to anticipate this type of threat as soon as a CVE is published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in JSP Store Locator Plugin A critical SQL Injection vulnerability (CVE-2024-11267) has been identified in the JSP Store Locator WordPress plugin, rated CVSS 8.8. This vulnerability allows registered users with low privileges to execute SQL injection attacks without requiring victim interaction. Affected users can potentially read, modify, or delete all database data, leading to severe impacts on confidentiality, integrity, and availability. The vulnerability exists due to improper sanitization and escaping of parameters in SQL statements. Users of the plugin are urged to update or uninstall it immediately and to monitor database logs for any signs of exploitation. Continuous monitoring solutions for WordPress are recommended to mitigate future threats. The CVE was published on May 15, 2025. 1 sources 73

Extracted Entities

CVE-2024-11267 — Critical SQL Injection (CVSS 8.8)

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)