EUVD-2026-35985
GHSA-wgfw-5cw7-xmvc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionNVD
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in the XStore WordPress theme before 9.7.3 allows remote attackers to inject arbitrary SQL queries through an AJAX action that fails to sanitise and escape a user-supplied parameter. Publicly available exploit code exists per WPScan, and the changed scope (S:C) with high confidentiality impact indicates an attacker can extract sensitive data across security boundaries - including WordPress user records, password hashes, and configuration secrets - without any credentials or user interaction.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication, no user interaction, and no special configuration are required - the vulnerable AJAX action is registered for unauthenticated users (wp_ajax_nopriv_*) and is reachable on default XStore deployments via /wp-admin/admin-ajax.php. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is high. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers an XStore-powered storefront through Wappalyzer or theme fingerprinting, then sends a single crafted HTTP POST to /wp-admin/admin-ajax.php invoking the vulnerable XStore AJAX action with a malicious UNION-based payload in the unsanitised parameter. The response leaks administrator password hashes from wp_users and the auth/secret keys from wp_options, which the attacker then cracks offline or replays to hijack admin sessions. … |
| Remediation | Upgrade the XStore theme to version 9.7.3 or later - this is the vendor-released patch and the only definitive fix; consult the WPScan advisory at https://wpscan.com/vulnerability/2c5bdb17-8b12-45b5-878b-627056dc8956/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-3326 for confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Update all XStore WordPress theme installations to version 9.7.3 or later across all environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that i
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticat
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline
Remote code execution in Edgar Rojas WooCommerce PDF Invoice Builder WordPress plugin (versions through 2.0.8) allows un
Share
External POC / Exploit Code
Leaving vuln.today