EUVD-2026-38697
GHSA-w2v5-gfq2-4h2f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable AJAX handler exploitable by any authenticated subscriber (PR:L), no UI; scope changes because disclosed admin hashes compromise other accounts (S:C, C:H).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free cornerstone Cornerstone WordPress plugin before 7.8.8 (v0.8.x) on the .org repository.
Articles & Coverage 1
AnalysisAI
Sensitive information disclosure in the premium Cornerstone page builder (bundled with the X theme) versions 3.0.0 through 7.8.7 allows any authenticated WordPress user to extract raw password hashes and other private user metadata. The CSS-preview request handler fails to enforce capability checks while exposing its required nonce on every wp-admin page, and publicly available exploit code exists per WPScan, though no active exploitation has been reported.
Technical ContextAI
Cornerstone is a premium drag-and-drop page builder for WordPress distributed as part of the X theme by Themeco. The flaw resides in one of its CSS-preview AJAX request handlers, which is intended for administrative theme customization but lacks a current_user_can() capability check. Compounding the issue, the WordPress nonce required to invoke the handler is rendered into the HTML of every wp-admin page for any logged-in user. The handler evaluates Cornerstone's dynamic content tokens (a templating feature for rendering user/post metadata) against an attacker-chosen user ID, returning sensitive fields including the user_pass hash from wp_users. This is a broken access control vulnerability (CWE-862 class) combined with information exposure of authentication credentials.
RemediationAI
Vendor-released patch: upgrade the premium Cornerstone plugin (bundled with the X theme) to version 7.8.8 or later, which adds the missing capability check on the CSS-preview handler. Site operators should obtain the update via their Themeco account or by updating the X theme bundle, as Cornerstone Pro is not distributed through the WordPress.org repository and will not auto-update through standard channels without a valid license. Until patching is possible, compensating controls include disabling new user registration (Settings > General > 'Anyone can register'), demoting or auditing existing low-privilege accounts, and using a WAF rule to block POST/GET requests to the Cornerstone CSS-preview AJAX action from non-administrator sessions - note this may break legitimate preview functionality for editors. Because password hashes may already have been exfiltrated, operators should also force a password reset for all users and rotate any secrets stored in user meta. Advisory references: https://wpscan.com/vulnerability/4fc21e38-f2df-41be-86b7-a897483574bb/ and https://nvd.nist.gov/vuln/detail/CVE-2026-9710.
More in Cornerstone
View allAuthenticated information disclosure in the premium Cornerstone page builder (bundled with the X WordPress theme) before
The mintToken function of a smart contract implementation for Cornerstone, an Ethereum token, has an integer overflow th
SQL injection in the Cornerstone WordPress plugin (Themeco) versions prior to 7.8.8 allows authenticated users with Subs
Arbitrary code execution in Themeco Cornerstone WordPress plugin versions prior to 7.8.8 allows authenticated low-privil
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today