CVE-2026-3326: Xstore WordPress Theme SQLi Vulnerability

CVE-2026-3326 Overview

CVE-2026-3326 is a SQL injection vulnerability in the Xstore WordPress theme versions prior to 9.7.3. The theme fails to sanitise and escape a user-supplied parameter before passing it into a SQL statement. The vulnerable code path is exposed through an AJAX action that is reachable by unauthenticated users. Remote attackers can inject arbitrary SQL to read database contents, including credentials, session tokens, and customer data stored by WooCommerce-backed stores. The flaw is tracked as CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database over the network with no user interaction.

Affected Products

Xstore WordPress theme versions before 9.7.3
WordPress sites using Xstore with the vulnerable AJAX action enabled
WooCommerce storefronts built on vulnerable Xstore releases

Discovery Timeline

2026-06-10 - CVE-2026-3326 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-3326

Vulnerability Analysis

The Xstore theme registers an AJAX handler that accepts a parameter from the HTTP request and concatenates it directly into a SQL query. Because the handler is wired to both wp_ajax_ and wp_ajax_nopriv_ hooks, unauthenticated visitors can invoke it through /wp-admin/admin-ajax.php. The parameter is neither escaped through esc_sql() nor bound using $wpdb->prepare(), allowing standard SQL injection payloads to alter the query structure.

A successful injection lets attackers extract data from any table accessible to the WordPress database user. This commonly includes wp_users password hashes, wp_usermeta session tokens, and order data in wp_woocommerce_order_items. Stacked queries are typically blocked by the MySQL driver used by WordPress, but UNION-based and time-based blind techniques remain effective.

Root Cause

The root cause is missing input sanitisation on a request parameter before it is interpolated into a SQL statement. The vulnerable handler trusts client-supplied data and does not use the WordPress prepared-statement API. No capability check or nonce verification gates the AJAX endpoint, eliminating authentication as a barrier.

Attack Vector

Exploitation is performed over the network by sending a crafted HTTP POST request to admin-ajax.php with the vulnerable AJAX action parameter and a malicious value for the injectable parameter. No credentials, user interaction, or prior access are required. The scope change in the CVSS vector reflects that data outside the immediate component, such as application-level secrets, can be retrieved.

Technical details are described in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-3326

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing SQL metacharacters such as UNION SELECT, SLEEP(, or INFORMATION_SCHEMA in parameter values.
Unauthenticated requests targeting the Xstore-specific AJAX action parameter from unusual source IPs.
Sudden spikes in MySQL query latency or error log entries referencing malformed SQL from the WordPress process.

Detection Strategies

Inspect web server access logs for admin-ajax.php calls referencing the Xstore AJAX action with encoded SQL payloads.
Deploy WAF signatures for SQL injection patterns against unauthenticated WordPress AJAX endpoints.
Correlate web request anomalies with database errors using OCSF-normalised log ingestion in a SIEM.

Monitoring Recommendations

Alert on repeated admin-ajax.php requests from a single IP exceeding baseline thresholds.
Monitor for new administrative users, modified theme files, and unexpected outbound connections from the web host.
Track WordPress theme version inventory to identify any host still running Xstore below 9.7.3.

How to Mitigate CVE-2026-3326

Immediate Actions Required

Upgrade the Xstore WordPress theme to version 9.7.3 or later on every affected site.
Audit wp_users and wp_usermeta for unauthorised accounts or modified roles created since the theme was installed.
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API tokens stored in the database.

Patch Information

The vendor has addressed the issue in Xstore 9.7.3. Site operators should update through the WordPress dashboard or replace the theme files manually, then clear any persistent object cache. See the WPScan advisory for the upstream reference.

Workarounds

Block unauthenticated access to the vulnerable AJAX action at the WAF or reverse proxy until the patch is applied.
Restrict admin-ajax.php to authenticated sessions where business requirements allow.
Apply database least-privilege by ensuring the WordPress MySQL user cannot read tables outside its schema.

bash

# Configuration example: ModSecurity rule to block the vulnerable AJAX action pre-patch
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1026332601,phase:2,deny,status:403,msg:'Block Xstore CVE-2026-3326 AJAX action'"
  SecRule ARGS:action "@rx ^(etheme_|xstore_)" \
    "chain"
    SecRule ARGS "@rx (?i)(union[\s/*]+select|sleep\(|information_schema|--|;)" \
      "t:none,t:urlDecodeUni"