What is the CVSS score of CVE-2026-49113?

CVE-2026-49113 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Cornerstone Plugin are affected by CVE-2026-49113?

Themeco Cornerstone, a widely-used WordPress plugin, contains a vulnerability allowing subscriber-level users to execute arbitrary code on web servers.. A patch is available.

How to fix or mitigate CVE-2026-49113?

Within 24 hours: inventory all WordPress installations using Themeco Cornerstone plugin versions prior to 7.8.8. Within 7 days: update all affected instances to version 7.8.8 or later. Within 30 days: verify patch deployment completeness and review access logs for suspicious activity from subscriber-level accounts.

Cornerstone Plugin CVE-2026-49113

EUVD-2026-37497 HIGH

Code Injection (CWE-94)

2026-06-16 Patchstack

WordPress RCE Code Injection Wordpress Plugin Cornerstone

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network-reachable WordPress endpoint (AV:N), requires Subscriber auth (PR:L), non-trivial exploitation conditions implied by advisory (AC:H), arbitrary code execution breaks out of plugin scope to host OS (S:C) with full CIA impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:25 vuln.today

Patch available

Jun 16, 2026 - 23:02 EUVD

DescriptionCVE.org

Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

AnalysisAI

Arbitrary code execution in Themeco Cornerstone WordPress plugin versions prior to 7.8.8 allows authenticated low-privilege users (Subscriber role) to inject and execute arbitrary code on the underlying server. The CVSS:3.1 vector indicates a scope-changed network-vector flaw with high impact on confidentiality, integrity, and availability, though high attack complexity tempers the realistic risk. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

Cornerstone is a popular front-end visual page builder plugin for WordPress developed by Themeco (CPE cpe:2.3:a:themeco:cornerstone). The root cause is classified as CWE-94 (Improper Control of Generation of Code), commonly arising when user-supplied input flows into PHP evaluation, template rendering, shortcode handlers, or AJAX endpoints that fail to enforce capability checks tied to the Subscriber role. Because WordPress permits open registration by default on many sites, Subscriber-level accounts are typically considered low-trust, making code-injection paths reachable from that role particularly dangerous in the WordPress ecosystem.

RemediationAI

Upgrade the Cornerstone plugin to version 7.8.8 or later, which is the vendor-released patch per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/cornerstone/vulnerability/wordpress-cornerstone-plugin-7-8-8-arbitrary-code-execution-vulnerability). Until the upgrade is applied, disable open user registration in WordPress Settings > General (unchecking 'Anyone can register'), audit existing Subscriber accounts and remove unknown ones, and consider temporarily deactivating the Cornerstone plugin on sites that cannot patch immediately - note that deactivation will break any front-end pages built with Cornerstone. A WAF rule restricting access to Cornerstone's AJAX/admin-ajax handlers to higher-privileged roles can serve as a stopgap, with the trade-off that legitimate builder functionality for authorized editors may be impacted.