CVE-2026-3326 is a SQL injection vulnerability in the Xstore WordPress theme prior to version 9.7.3. The issue arises from improper sanitization and escaping of a parameter in an AJAX action that is available to unauthenticated users. This vulnerability enables attackers to inject malicious SQL code, potentially compromising the database integrity or confidentiality.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the privileges of the database user. The vulnerability is exploitable without authentication, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 9.7.3, upgrading to version 9.7.3 or later is likely the intended fix once officially released. Until then, restrict access to the vulnerable AJAX action if possible or apply any vendor-provided temporary mitigations.