External risk intelligence

Nikstore Core Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73388

The vulnerability affects a web plugin (Nikstore Core) which typically functions as a web application component. As an unauthenticated SQL injection point within a web-facing plugin, it is commonly deployed in internet-facing web environments, making the vulnerable surface reachable from the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the Nikstore Core technology, specifically related to SQL injection. This issue allows unauthenticated access, potentially impacting data integrity and availability by enabling unauthorized manipulation of databases. The primary concern is to determine if this technology is in use and assess any associated exposure.

Unauthenticated database access flaw found.
Critical flaw could expose sensitive information.
Confirm relevance and potential exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker can target Nikstore Core by sending specially crafted requests over the network. Because no authentication is required, an unauthenticated attacker can trigger this vulnerability. This could allow the attacker to interfere with the application's intended operations or gain unauthorized access to data.

No authentication required.
SQL injection in Nikstore Core.
Data access and service disruption.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated SQL injection in Nikstore Core could allow an attacker to access sensitive database information when supported by the advisory. This vulnerability could expose the integrity of the database and impact service availability.

Database information could be accessed.
Via network with no authentication.
Service integrity and availability may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in Nikstore Core affects web applications and likely falls under the responsibility of the application owner or platform team managing the web environment. The first practical step is to identify all instances of Nikstore Core, determine their internet reachability and business criticality, and then assign an accountable owner for remediation.

Application owners should manage this issue.
Verify internet-facing instances first.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Nikstore Core?

Nikstore Core is a software plugin designed for web environments, frequently used to manage e-commerce functions or storefront operations within a content management system. It acts as an underlying component that handles data processing and database interactions for the application.

What does SQL injection mean for CVE-2026-73388?

This vulnerability is classified as CWE-89, which occurs when software improperly handles user-provided data before including it in a database query. In this case, the flaw allows an attacker to manipulate the structure of those queries, potentially accessing or altering information in the database that the plugin was intended to protect.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specifically crafted network requests to the Nikstore Core component. Because the vulnerability does not require authentication, the attacker does not need to log in or hold valid user credentials to initiate the attack. However, simply visiting the site or browsing standard pages will not trigger the issue; the attacker must intentionally send malformed data inputs designed to exploit the database query logic.

Is my instance of Nikstore Core at risk?

Halo Surface Signal indicates this vulnerability is likely to affect internet-facing web environments. If you have instances of Nikstore Core accessible from the public internet, they are reachable by unauthorized parties. Systems that are restricted to internal, private networks still face risk from internal actors, but the primary concern for most teams is verifying whether the vulnerable plugin is deployed on external-facing web properties.

What should I do first to address this?

Your first step is to perform an inventory of all applications within your environment to identify where Nikstore Core is currently installed. Once identified, prioritize these instances based on their internet exposure and the sensitivity of the data they manage. Assign a team to monitor for updates or official guidance from the software maintainers to plan for the necessary remediation of these instances.

References

patchstack.com/database/wordpress/plugin/nikstore-core/vulnerability…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.