CVE-2026-3326 describes a SQL injection vulnerability (CWE-89) in the Xstore WordPress theme before version 9.7.3. The issue arises from improper sanitization and escaping of a parameter used in a SQL query via an AJAX action that does not require authentication. This flaw enables remote attackers to perform SQL injection attacks, potentially compromising the confidentiality of the database. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.6, indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database due to SQL injection. The vulnerability does not impact integrity or availability according to the CVSS vector. Since the AJAX action is accessible without authentication, the attack surface is broad, allowing remote attackers to exploit the flaw without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable AJAX action if possible. Monitor official Xstore theme channels for updates and apply the patch promptly once available.