Samex WooCommerce Theme CVE-2026-28154

Exploitation requires that the target WordPress installation has either the Samex theme at version 2.5 or earlier, or the M.Anh theme at version 1.7 or earlier, set as the active theme, and that the WooCommerce plugin is installed and active. The CVSS vector (PR:N) confirms no attacker authentication is required. However, UI:R confirms the attack is not autonomous: a human victim must visit a specially crafted URL - the payload is not persistently stored and will not execute without this interaction. Attack effectiveness is maximized when the victim is an authenticated WordPress administrator, since their session context enables the most impactful post-exploitation actions. Limiting factors include the social engineering dependency for every exploitation event, the requirement that the specific vulnerable theme is the active (not merely installed) theme, and the reflected delivery model that leaves forensic traces in server access logs for each attempt.

The CVSS 3.1 score of 7.1 reflects a network-reachable, low-complexity reflected XSS with no privilege requirement on the attacker side (PR:N), but the mandatory victim interaction (UI:R) meaningfully caps real-world exploitability relative to a stored or DOM-based variant. The scope change (S:C) elevates the score by acknowledging that a successful payload crosses the browser's same-origin boundary, enabling downstream impact on resources the victim controls within the WordPress origin. No EPSS probability score was included in the available intelligence, and the absence of a CISA KEV listing indicates no confirmed mass exploitation at time of analysis. The realistic threat model is targeted and phishing-dependent: an attacker must socially engineer a privileged user into clicking a crafted link, which means even a mid-sized municipal IT team in mielec running a WooCommerce storefront on these themes should treat this as a meaningful but non-opportunistic phishing vector rather than a remotely self-propagating risk. SSVC signals suggest exploitation status is unconfirmed, the attack is partially automatable (payload construction is trivial but delivery requires human deception), and technical impact is partial. Overall priority is moderate for sites actively running these specific themes, primarily as a session-hijacking vector targeting shop administrators.

An attacker identifies a public-facing WooCommerce store running Samex version 2.5 or M.Anh version 1.7, then crafts a shop or search URL embedding a JavaScript payload within a query parameter that the theme reflects unsanitized into the page response. The attacker sends this URL to the store administrator via a phishing email disguised as a customer inquiry or order notification; upon clicking, the administrator's browser executes the payload within the WordPress origin, enabling the attacker to exfiltrate the session cookie or silently trigger authenticated WordPress REST API calls to create a rogue administrator account. No public proof-of-concept code has been identified at time of analysis, though reflected XSS payloads of this class require no specialized tooling to construct.