EUVD-2026-38696
GHSA-c9vf-p6xc-gxq6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable REST API, low complexity, any authenticated user (PR:L); scope changes since one user reads others' data; confidentiality-only impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free cornerstone Cornerstone WordPress plugin before 7.8.9 (v0.8.x) on the .org repository.
Articles & Coverage 1
AnalysisAI
Authenticated information disclosure in the premium Cornerstone page builder (bundled with the X WordPress theme) before version 7.8.9 allows any logged-in user to enumerate other users' metadata via an unprotected REST API route. Disclosed data includes roles, session token previews, and stored billing/shipping fields, enabling account targeting and potential session abuse. Publicly available exploit code exists per WPScan, though there is no public exploit identified as actively used in the wild and the issue is not listed in CISA KEV.
Technical ContextAI
Cornerstone is a commercial drag-and-drop page builder distributed bundled with the X WordPress theme by Themeco. The flaw lives in one of the plugin's WordPress REST API routes that fails to invoke a capability check (e.g., current_user_can) before returning user metadata - a classic broken access control pattern (CWE-862 Missing Authorization / CWE-285 Improper Authorization). Because WordPress REST routes inherit authentication from the logged-in cookie/nonce context, any subscriber-level account is sufficient to invoke the route and read fields that should be restricted to administrators or the owning user, including WooCommerce billing/shipping metadata and session token previews stored in user meta. The CPE 'cpe:2.3:a:unknown:cornerstone' is generic and does not distinguish the premium Themeco product from the unrelated free 'cornerstone' plugin on .org - only the premium X-bundled version is affected.
RemediationAI
Upgrade the premium Cornerstone plugin / X theme bundle to version 7.8.9 or later, which is the vendor-released patched version per the WPScan advisory (https://wpscan.com/vulnerability/3ade0e4e-2070-4d3b-8f31-0d446839efd0/). If immediate patching is not possible, disable open user registration in WordPress Settings → General to remove the trivial subscriber-acquisition path, and consider temporarily blocking or restricting the affected Cornerstone REST API namespace at the web server or WAF layer (e.g., deny non-admin access to /wp-json/cornerstone/* routes) - be aware this will break front-end page builder previews and any logged-in editing workflows that depend on those endpoints. For WooCommerce sites, audit recent user activity logs for unusual REST API calls and rotate any session-sensitive credentials for privileged accounts as a precaution. Verify the fix by confirming the installed version reports 7.8.9+ via Themeco's dashboard.
More in Cornerstone
View allSensitive information disclosure in the premium Cornerstone page builder (bundled with the X theme) versions 3.0.0 throu
The mintToken function of a smart contract implementation for Cornerstone, an Ethereum token, has an integer overflow th
SQL injection in the Cornerstone WordPress plugin (Themeco) versions prior to 7.8.8 allows authenticated users with Subs
Arbitrary code execution in Themeco Cornerstone WordPress plugin versions prior to 7.8.8 allows authenticated low-privil
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today