EUVD-2026-38697
GHSA-w2v5-gfq2-4h2f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable AJAX handler exploitable by any authenticated subscriber (PR:L), no UI; scope changes because disclosed admin hashes compromise other accounts (S:C, C:H).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free cornerstone Cornerstone WordPress plugin before 7.8.8 (v0.8.x) on the .org repository.
Articles & Coverage 1
AnalysisAI
Sensitive information disclosure in the premium Cornerstone page builder (bundled with the X theme) versions 3.0.0 through 7.8.7 allows any authenticated WordPress user to extract raw password hashes and other private user metadata. The CSS-preview request handler fails to enforce capability checks while exposing its required nonce on every wp-admin page, and publicly available exploit code exists per WPScan, though no active exploitation has been reported.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) the target site to run the premium Cornerstone page builder (bundled with the X theme by Themeco) at any version from 3.0.0 up to but not including 7.8.8, and (2) the attacker to hold any authenticated WordPress account at subscriber level or higher - typically obtained via open user registration, a customer/membership account, or a compromised low-privilege account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 score with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N accurately reflects a network-exploitable, low-complexity flaw requiring only subscriber-level authentication, with scope change because the disclosed password hashes affect other users (including administrators). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber-level account on a WordPress site running vulnerable Cornerstone, then loads any wp-admin page to scrape the exposed nonce. They send a crafted CSS-preview request supplying the administrator's user ID and a dynamic content token referencing user_pass, receiving the administrator's bcrypt hash in the response, which they crack offline to gain full administrative control of the site. … |
| Remediation | Vendor-released patch: upgrade the premium Cornerstone plugin (bundled with the X theme) to version 7.8.8 or later, which adds the missing capability check on the CSS-preview handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress installations using Cornerstone/X theme versions 3.0.0-7.8.7 and document affected user accounts with site access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cornerstone
View allAuthenticated information disclosure in the premium Cornerstone page builder (bundled with the X WordPress theme) before
SQL injection in the Cornerstone WordPress plugin (Themeco) versions prior to 7.8.8 allows authenticated users with Subs
Arbitrary code execution in Themeco Cornerstone WordPress plugin versions prior to 7.8.8 allows authenticated low-privil
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today