CVE-2026-9709: Cornerstone Plugin Info Disclosure Bug

CVE-2026-9709 Overview

CVE-2026-9709 affects the premium Cornerstone page builder WordPress plugin distributed bundled with the X theme, in versions before 7.8.9. The plugin fails to enforce capability checks on one of its REST API routes. Any authenticated user can disclose metadata of any other user, including roles, session token previews, and stored billing and shipping fields. This issue does not affect the unrelated free cornerstone plugin (v0.8.x) hosted on the WordPress.org repository.

Critical Impact
Authenticated low-privileged users can enumerate sensitive metadata for every account on the site, including administrator roles, session token previews, and billing or shipping data.

Affected Products

Cornerstone WordPress plugin (premium, bundled with X theme) before 7.8.9
WordPress sites distributing the X theme with bundled Cornerstone
Not affected: free cornerstone plugin on WordPress.org (v0.8.x)

Discovery Timeline

2026-06-24 - CVE-2026-9709 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-9709

Vulnerability Analysis

The vulnerability is a broken access control issue in a Cornerstone REST API route. The route accepts requests from any authenticated user and returns metadata for arbitrary user IDs. The handler omits a permission_callback that verifies the caller holds an administrative capability such as list_users or edit_users.

Returned data includes assigned roles, partial session token previews stored in user meta, and WooCommerce billing and shipping fields when present. Exposure of role assignments lets an attacker enumerate administrator accounts to target with follow-on attacks. Session token previews and personal data create direct paths to account takeover and privacy violations.

The issue is scoped beyond the vulnerable component because data belonging to other users is exposed, which aligns with the changed scope reflected in the CVSS vector.

Root Cause

The root cause is a missing authorization check on a REST endpoint registered by Cornerstone. WordPress requires plugin authors to supply a permission_callback when calling register_rest_route. The vulnerable route either returns true unconditionally or relies on is_user_logged_in, which does not constrain access by capability.

Attack Vector

An attacker first obtains any authenticated session, including a subscriber or customer account created through self-registration. The attacker then issues authenticated HTTP requests to the vulnerable Cornerstone REST route, iterating user IDs to harvest metadata. No user interaction is required, and the request can be automated. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-9709

Indicators of Compromise

Repeated authenticated requests to Cornerstone REST API paths under /wp-json/cornerstone/ originating from low-privileged accounts
Sequential enumeration patterns iterating numeric user_id parameters within short time windows
Unusual REST traffic from subscriber or customer accounts that normally do not interact with builder endpoints
Spikes in 200 OK responses to user metadata routes from a single IP or session

Detection Strategies

Inspect WordPress access logs for authenticated calls to Cornerstone REST routes by non-administrative users
Correlate REST endpoint access with user role from the WordPress session to flag privilege mismatches
Alert when a single account requests metadata for more than a small threshold of distinct user IDs
Review web application firewall logs for sequential ID enumeration patterns against /wp-json/ paths

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform such as Singularity Data Lake for OCSF-normalized correlation and retention
Monitor account creation rates and pair new accounts with their first REST API call patterns
Track outbound data volumes from REST endpoints to identify bulk metadata exfiltration

How to Mitigate CVE-2026-9709

Immediate Actions Required

Update the bundled Cornerstone plugin to version 7.8.9 or later through the X theme update channel
Audit existing user accounts and rotate credentials for any administrator whose session token preview may have been disclosed
Review recent registrations and disable self-registration on sites that do not require it
Inspect access logs for prior exploitation against Cornerstone REST routes

Patch Information

The vendor addressed the issue in Cornerstone 7.8.9 by adding capability checks to the affected REST API route. Site operators using the X theme should apply the theme and bundled plugin update that ships Cornerstone 7.8.9 or later. Refer to the WPScan Vulnerability Report for advisory references.

Workarounds

Restrict access to /wp-json/cornerstone/ routes at the web application firewall to administrator IP ranges until the patch is applied
Disable open user registration to limit the pool of authenticated attackers
Temporarily deactivate Cornerstone on sites that do not actively use the page builder

bash

# Example WAF rule restricting Cornerstone REST routes to admin source IPs
location ~ ^/wp-json/cornerstone/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny  all;
}