What is the CVSS score of CVE-2026-54185?

CVE-2026-54185 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Cornerstone are affected by CVE-2026-54185?

The Cornerstone WordPress plugin (Themeco) contains a SQL injection vulnerability (CVE-2026-54185) that allows subscriber-level users to extract sensitive data directly from the website database,…. A patch is available.

How to fix or mitigate CVE-2026-54185?

Within 24 hours: Enumerate all WordPress installations running Cornerstone plugin and identify all active subscriber-level accounts on affected systems. Within 7 days: Deploy Web Application Firewall rules to block SQL injection attempts against the plugin; restrict subscriber account creation and audit existing accounts for legitimacy; implement database query logging and monitoring for suspicious SQL patterns. Within 30 days: Monitor Themeco security advisories for release of version 7.8.8 patch; evaluate plugin replacement options if vendor patch is not released within acceptable risk window; conduct forensic review of database access logs for indicators of exploitation.

Cornerstone CVE-2026-54185

EUVD-2026-37630 HIGH

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Cornerstone

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable WordPress endpoint (AV:N, AC:L) requires a Subscriber account (PR:L); SQLi reads cross-scope data (S:C, C:H) with no integrity change and minor availability impact from heavy queries.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:01 EUVD

Analysis Generated

Jun 17, 2026 - 11:58 vuln.today

DescriptionCVE.org

Subscriber SQL Injection in Cornerstone < 7.8.8 versions.

AnalysisAI

SQL injection in the Cornerstone WordPress plugin (Themeco) versions prior to 7.8.8 allows authenticated users with Subscriber-level access to inject SQL into backend queries. Per the CVSS vector (PR:L, scope changed, C:H), a low-privileged WordPress account can read sensitive database contents - including credentials and PII - across security boundaries, with limited availability impact and no integrity impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Cornerstone is a commercial page-builder plugin for WordPress developed by Themeco, identified by CPE cpe:2.3:a:themeco:cornerstone. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a SQL query without being properly sanitized or parameterized - typically via $wpdb queries that concatenate request parameters instead of using prepared statements with placeholders. Because WordPress's Subscriber role is the lowest authenticated tier (granted by default on sites allowing open registration), any AJAX or REST endpoint exposed to authenticated users that builds SQL from request input becomes reachable by attackers who merely register an account.

RemediationAI

Vendor-released patch: upgrade Cornerstone to version 7.8.8 or later via the Themeco/WordPress plugin updater, which is the only complete fix; review the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cornerstone/vulnerability/wordpress-cornerstone-plugin-7-8-8-sql-injection-vulnerability for advisory details. If immediate patching is not possible, compensating controls include disabling new user registration in WordPress Settings → General (trade-off: breaks public sign-up flows), demoting or removing untrusted Subscriber accounts, deploying a WAF rule (Wordfence, Patchstack, or Cloudflare) to block SQL-injection payloads on Cornerstone's AJAX/REST endpoints (trade-off: may produce false positives on legitimate page-builder traffic), and rotating WordPress secret keys plus forcing password resets if compromise is suspected, since SQLi at Subscriber level can exfiltrate password hashes.