EUVD-2026-38696
GHSA-c9vf-p6xc-gxq6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable REST API, low complexity, any authenticated user (PR:L); scope changes since one user reads others' data; confidentiality-only impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free cornerstone Cornerstone WordPress plugin before 7.8.9 (v0.8.x) on the .org repository.
Articles & Coverage 1
AnalysisAI
Authenticated information disclosure in the premium Cornerstone page builder (bundled with the X WordPress theme) before version 7.8.9 allows any logged-in user to enumerate other users' metadata via an unprotected REST API route. Disclosed data includes roles, session token previews, and stored billing/shipping fields, enabling account targeting and potential session abuse. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account of any role (subscriber or above) on a site running the premium Cornerstone page builder bundled with the X theme at versions 3.0.0 through 7.8.8 - the free .org 'cornerstone' plugin (v0.8.x) is explicitly NOT affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 (High) score is driven by the Scope:Changed metric (S:C) reflecting that one user's account can disclose data belonging to other users/security authorities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers (or compromises) a low-privileged subscriber account on a target WordPress site running vulnerable Cornerstone, then issues an authenticated request to the unprotected Cornerstone REST API route to enumerate user IDs and harvest roles, session token previews, and billing/shipping PII for administrators and customers. The harvested data fuels targeted phishing, credential-stuffing against admin accounts, or downstream identity fraud against WooCommerce customers. … |
| Remediation | Upgrade the premium Cornerstone plugin / X theme bundle to version 7.8.9 or later, which is the vendor-released patched version per the WPScan advisory (https://wpscan.com/vulnerability/3ade0e4e-2070-4d3b-8f31-0d446839efd0/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Review audit logs for evidence of metadata enumeration activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cornerstone
View allSensitive information disclosure in the premium Cornerstone page builder (bundled with the X theme) versions 3.0.0 throu
SQL injection in the Cornerstone WordPress plugin (Themeco) versions prior to 7.8.8 allows authenticated users with Subs
Arbitrary code execution in Themeco Cornerstone WordPress plugin versions prior to 7.8.8 allows authenticated low-privil
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today