The XStore WordPress theme, versions prior to 9.7.3, contains an unauthenticated SQL injection flaw. An attacker can craft a malicious request to the theme’s AJAX endpoint, as no proper input sanitisation or escaping is performed before the value is incorporated into a SQL query. Successful exploitation could allow the attacker to read, modify, or delete database contents, compromising confidentiality, integrity, and availability of site data.

The vulnerability affects the XStore WordPress theme before version 9.7.3. Any WordPress site using XStore prior to the 9.7.3 release is potentially impacted.

The attack vector is through an unauthenticated AJAX action that accepts crafted input. Because the user is not required to authenticate, any network user can attempt the injection. No EPSS data is available and the flaw is not listed in the CISA KEV catalog, but the lack of protection and the potential for full database compromise indicates a high severity risk. The CVSS score is 8.6. Exploitation does not require privileged access or complex setup beyond sending a specially constructed HTTP request to the vulnerable endpoint.