What is the CVSS score of CVE-2026-3326?

CVE-2026-3326 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of XStore WordPress Theme are affected by CVE-2026-3326?

The XStore WordPress theme contains an unauthenticated SQL injection vulnerability with publicly available exploit code, allowing attackers to extract sensitive user data without any credentials.. A patch is available.

Is there a public PoC exploit available for CVE-2026-3326?

Yes, a public proof-of-concept exploit is available for CVE-2026-3326. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3326?

Within 24 hours: Update all XStore WordPress theme installations to version 9.7.3 or later across all environments. Within 7 days: Verify successful updates and review application logs for exploitation attempts targeting AJAX parameters. Within 30 days: Conduct forensic audit of database access logs for unauthorized queries; reset all WordPress administrative account passwords.

XStore WordPress Theme CVE-2026-3326

EUVD-2026-35985 HIGH

SQL Injection (CWE-89)

2026-06-10 WPScan

GHSA-wgfw-5cw7-xmvc

SQLi WordPress Xstore

8.6

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 11:22 vuln.today

CVSS changed

Jun 10, 2026 - 11:22 NVD

8.6 (HIGH)

Patch available

Jun 10, 2026 - 08:01 EUVD

CVE Published

Jun 10, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 10, 2026 - 06:00 nvd

HIGH 8.6

DescriptionCVE.org

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 2 Critical, 3 With POC Jun 11, 2026

AnalysisAI

Unauthenticated SQL injection in the XStore WordPress theme before 9.7.3 allows remote attackers to inject arbitrary SQL queries through an AJAX action that fails to sanitise and escape a user-supplied parameter. Publicly available exploit code exists per WPScan, and the changed scope (S:C) with high confidentiality impact indicates an attacker can extract sensitive data across security boundaries - including WordPress user records, password hashes, and configuration secrets - without any credentials or user interaction.

Technical ContextAI

XStore is a widely deployed commercial WooCommerce/WordPress theme used to power e-commerce storefronts. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw in which a parameter passed to a registered AJAX endpoint (typically wp_ajax_nopriv_* handlers, which are reachable by unauthenticated users) is concatenated into a SQL statement without going through WordPress's $wpdb->prepare() or proper escaping helpers. The CPE cpe:2.3:a:unknown:xstore:*:*:*:*:*:*:*:* covers all XStore theme versions prior to the fixed 9.7.3 release. Because WordPress AJAX endpoints execute under the same database privileges as the site itself, injection here yields direct read access to the wp_users, wp_usermeta, and wp_options tables.

RemediationAI

Upgrade the XStore theme to version 9.7.3 or later - this is the vendor-released patch and the only definitive fix; consult the WPScan advisory at https://wpscan.com/vulnerability/2c5bdb17-8b12-45b5-878b-627056dc8956/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-3326 for confirmation. If immediate upgrade is not possible, deploy a WAF rule (Wordfence, Sucuri, or ModSecurity OWASP CRS) that blocks SQL injection patterns on requests to /wp-admin/admin-ajax.php targeting XStore-specific action names, accepting that overly broad rules may generate false positives on legitimate AJAX traffic. As an additional compensating control, restrict database privileges of the WordPress MySQL user to the minimum required (no FILE, no cross-database SELECT) to limit blast radius, and rotate any administrator passwords and secret keys in wp-config.php after patching, since unauthenticated read access may have already exposed wp_users hashes.