What is the CVSS score of CVE-2026-3326?

CVE-2026-3326 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-3326?

Yes, a public proof-of-concept exploit is available for CVE-2026-3326. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3326?

Within 24 hours: Update all XStore WordPress theme installations to version 9.7.3 or later across all environments. Within 7 days: Verify successful updates and review application logs for exploitation attempts targeting AJAX parameters. Within 30 days: Conduct forensic audit of database access logs for unauthorized queries; reset all WordPress administrative account passwords.

XStore WordPress Theme CVE-2026-3326

EUVD-2026-35985 HIGH

SQL Injection (CWE-89)

2026-06-10 WPScan

GHSA-wgfw-5cw7-xmvc

WordPress SQLi Xstore Unknown

8.6

CVSS 3.1 · Vendor: WPScan

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Fingerprint XStore theme version
Delivery

Send crafted POST to admin-ajax.php
Exploit

Inject SQL via vulnerable AJAX parameter
Install

Exfiltrate wp_users hashes and secret keys
C2

Crack hashes offline
Execute

Authenticate as administrator
Impact

Deploy webshell or plugin backdoor

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No authentication, no user interaction, and no special configuration are required - the vulnerable AJAX action is registered for unauthenticated users (wp_ajax_nopriv_*) and is reachable on default XStore deployments via /wp-admin/admin-ajax.php. The only prerequisites are that the target site runs the XStore theme at a version below 9.7.3 and that /wp-admin/admin-ajax.php is reachable from the attacker's network (the standard configuration for any public WordPress site). Limiting factors: a WAF in front of the site may block obvious SQLi payloads, and sites that have hardened admin-ajax.php access at the web-server layer would not be reachable; the impact is also limited to information disclosure (C:H/I:N/A:N), so direct site takeover requires a follow-on step such as cracking extracted hashes.
Impact	Real-world risk is high. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates a remote, low-complexity, unauthenticated attack with no user interaction - the easiest possible exploitation profile. The Scope:Changed with C:H/I:N/A:N tells us the bug is information-disclosure-only at the database layer but crosses authorization boundaries (the unauthenticated AJAX handler reads data the requester should not see). Publicly available exploit code (WPScan) means commodity attackers and automated scanners can weaponize this immediately against the large installed base of WordPress sites running XStore. The CVE is NOT currently listed in CISA KEV and no EPSS score is provided in the input, so widespread exploitation is not yet confirmed - but the combination of unauthenticated reachability, public POC, and a popular commercial theme target makes opportunistic mass-scanning highly likely. This is a real priority, not a paper-tiger CVSS.
Exploit ScenarioDerived	An attacker discovers an XStore-powered storefront through Wappalyzer or theme fingerprinting, then sends a single crafted HTTP POST to /wp-admin/admin-ajax.php invoking the vulnerable XStore AJAX action with a malicious UNION-based payload in the unsanitised parameter. The response leaks administrator password hashes from wp_users and the auth/secret keys from wp_options, which the attacker then cracks offline or replays to hijack admin sessions. Because public exploit code exists via WPScan, this is achievable by commodity scanners with minimal customization.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 10, 2026

Unauthenticated SQL injection in the XStore WordPress theme before 9.7.3 allows remote attackers to inject arbitrary SQL queries through an AJAX action that fails to sanitise and escape a user-supplied parameter. Publicly available exploit code exists per WPScan, and the changed scope (S:C) with high confidentiality impact indicates an attacker can extract sensitive data across security boundaries - including WordPress user records, password hashes, and configuration secrets - without any credentials or user interaction.

RemediationAI

Upgrade the XStore theme to version 9.7.3 or later - this is the vendor-released patch and the only definitive fix; consult the WPScan advisory at https://wpscan.com/vulnerability/2c5bdb17-8b12-45b5-878b-627056dc8956/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-3326 for confirmation. If immediate upgrade is not possible, deploy a WAF rule (Wordfence, Sucuri, or ModSecurity OWASP CRS) that blocks SQL injection patterns on requests to /wp-admin/admin-ajax.php targeting XStore-specific action names, accepting that overly broad rules may generate false positives on legitimate AJAX traffic. As an additional compensating control, restrict database privileges of the WordPress MySQL user to the minimum required (no FILE, no cross-database SELECT) to limit blast radius, and rotate any administrator passwords and secret keys in wp-config.php after patching, since unauthenticated read access may have already exposed wp_users hashes.

Affected VersionsENISA

XStore 0 <9.7.3

Affected Packages

euvd xstore fix: 9.7.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

XStore is a widely deployed commercial WooCommerce/WordPress theme used to power e-commerce storefronts. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw in which a parameter passed to a registered AJAX endpoint (typically wp_ajax_nopriv_* handlers, which are reachable by unauthenticated users) is concatenated into a SQL statement without going through WordPress's $wpdb->prepare() or proper escaping helpers. The CPE cpe:2.3:a:unknown:xstore:*:*:*:*:*:*:*:* covers all XStore theme versions prior to the fixed 9.7.3 release. Because WordPress AJAX endpoints execute under the same database privileges as the site itself, injection here yields direct read access to the wp_users, wp_usermeta, and wp_options tables.

Know when Xstore gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (WPScan) PRIMARY 8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jun 10, 2026 - 11:22 NVD

8.6 (HIGH)

Patch available

Jun 10, 2026 - 08:01 EUVD

CVE Published

Jun 10, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 10, 2026 - 06:00 nvd

HIGH 8.6

DescriptionCVE.org

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 2 Critical, 3 With POC Jun 11, 2026

Executive ViewAI

Why It Matters

The XStore WordPress theme contains an unauthenticated SQL injection vulnerability with publicly available exploit code, allowing attackers to extract sensitive user data without any credentials. Organizations using affected theme versions below 9.7.3 face imminent risk of unauthorized access to WordPress user records, password hashes, and system configuration. Immediate action required to prevent data compromise.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 80% exploitable

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment POC (1) CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.