CVE-2026-49113: Cornerstone RCE Vulnerability

CVE-2026-49113 Overview

CVE-2026-49113 is an arbitrary code execution vulnerability affecting the Cornerstone WordPress plugin in versions prior to 7.8.8. The flaw allows an authenticated attacker with Subscriber-level privileges to execute arbitrary code on the underlying server. The issue is tracked under CWE-94: Improper Control of Generation of Code.

The vulnerability carries a CVSS 3.1 score of 8.5 and a network-based attack vector. Because Subscriber accounts are typically self-registerable on many WordPress sites, the barrier to exploitation is low once registration is enabled.

Critical Impact
An authenticated Subscriber can execute arbitrary code, leading to full compromise of the WordPress site and potentially the underlying host.

Affected Products

Cornerstone WordPress plugin versions prior to 7.8.8

Discovery Timeline

2026-06-17 - CVE-2026-49113 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49113

Vulnerability Analysis

CVE-2026-49113 is classified as Arbitrary Code Execution stemming from improper control of code generation [CWE-94]. The Cornerstone plugin exposes functionality that processes attacker-controlled input in a way that allows it to be interpreted as executable code by the PHP runtime. An authenticated user holding only the Subscriber role can reach the affected code path, which violates the privilege separation expected for WordPress content roles.

Successful exploitation results in code running in the context of the web server process. The attacker can read site secrets, pivot to the database, drop a web shell, or modify content. The scope change in the CVSS vector reflects that exploitation impacts resources beyond the vulnerable component, including the broader hosting environment.

Root Cause

The root cause is insufficient validation and sanitization of user-supplied input before it is incorporated into dynamically evaluated code or function calls. Plugin code paths reachable by low-privilege authenticated users do not enforce capability checks consistent with the sensitivity of the underlying operation. See the Patchstack Vulnerability Report for technical details.

Attack Vector

The attack is delivered remotely over HTTP(S) to a WordPress site running a vulnerable Cornerstone version. The attacker first authenticates as a Subscriber, either by registering on a site with open registration or by leveraging stolen credentials. The attacker then issues a crafted request to the vulnerable plugin endpoint, where the payload is processed and executed by the PHP interpreter. No user interaction from administrators is required, and exploitation does not require any plugin reconfiguration.

Detection Methods for CVE-2026-49113

Indicators of Compromise

Unexpected PHP files or modified theme/plugin files under wp-content/ with recent modification timestamps.
New or modified WordPress administrator accounts created shortly after Subscriber account activity.
Outbound network connections from the web server to unknown hosts following authenticated Subscriber requests to Cornerstone endpoints.
Web server logs showing POST requests from Subscriber sessions to Cornerstone AJAX or REST routes followed by anomalous responses.

Detection Strategies

Inventory all WordPress installations and identify Cornerstone plugin versions below 7.8.8.
Alert on PHP process spawning shell utilities (sh, bash, python, curl, wget) under the web server user.
Correlate WordPress authentication events for low-privilege roles with subsequent file system writes inside the web root.

Monitoring Recommendations

Enable WordPress audit logging to capture role usage, plugin actions, and file changes.
Forward web server access logs and PHP-FPM logs to a centralized analytics platform for query and retention.
Monitor for creation of new administrator users and changes to plugin or theme files outside maintenance windows.

How to Mitigate CVE-2026-49113

Immediate Actions Required

Update the Cornerstone plugin to version 7.8.8 or later on all WordPress instances.
Audit user accounts and remove unknown Subscriber-level accounts created before patching.
Review web-root directories for unauthorized PHP files and revert unexpected changes.
Rotate WordPress secret keys in wp-config.php and reset administrator passwords if compromise is suspected.

Patch Information

Upgrade Cornerstone to version 7.8.8 or later. Refer to the Patchstack Vulnerability Report for vendor advisory details.

Workarounds

Disable open user registration in WordPress under Settings → General until patching is complete.
Deactivate the Cornerstone plugin on sites where immediate patching is not possible.
Restrict access to /wp-admin/admin-ajax.php and Cornerstone REST endpoints via a web application firewall rule for non-administrator roles.

bash

# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0

# Verify installed Cornerstone version across sites
wp plugin get cornerstone --field=version

# Update Cornerstone to the patched release
wp plugin update cornerstone --version=7.8.8