CVE-2026-3326: XStore < 9.7.3 - Unauthenticated SQLi

Synopsis

An unauthenticated SQL injection vulnerability affects the XStore WordPress theme before version 9.7.3. The flaw is reachable over the network with no credentials required: a parameter passed through an AJAX action is used in a SQL query without sanitization or escaping. Successful exploitation lets an attacker read arbitrary data from the WordPress database. A patched-image rebuild at version 9.7.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX endpoint is exposed over the network, so an attacker must be able to reach the WordPress instance via HTTP/HTTPS.

• AuthenticationNot required

  The AJAX action is available to unauthenticated users, so no account or session token is needed to send the malicious request.

• Victim interactionNot required

  The attacker sends the crafted request directly to the server; no user action or social engineering is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions such as race timing or specific memory layout.

Blast Radius

• Reads arbitrary rows from the WordPress database, including wp_users entries containing hashed passwords and email addresses.
• Reads stored session tokens, authentication keys, and secret salts from wp_options, enabling further account takeover.
• Reads any custom post type or metadata stored by WooCommerce or other plugins, including order details and customer PII.
• The scope is changed (S:C in the CVSS vector), meaning the impact extends beyond the vulnerable component to other resources sharing the database.