CVE-2026-9710: Cornerstone Information Disclosure Flaw

CVE-2026-9710 Overview

CVE-2026-9710 affects the premium Cornerstone page builder plugin for WordPress, bundled with the X theme, in versions before 7.8.8. The plugin fails to enforce capability checks on one of its CSS-preview request handlers. The nonce required to invoke the handler is exposed to every authenticated user on any wp-admin page. Any logged-in user can evaluate dynamic content tokens against arbitrary user accounts and disclose sensitive metadata, including raw password hashes. This issue does not affect the unrelated free cornerstone plugin (v0.8.x) published on the WordPress.org repository.

Critical Impact
Authenticated low-privilege users can extract password hashes and sensitive metadata belonging to any user, including administrators, enabling offline cracking and full site compromise.

Affected Products

Cornerstone WordPress plugin (premium, bundled with X theme) versions prior to 7.8.8
WordPress sites distributing the X theme with bundled Cornerstone
Not affected: free cornerstone plugin (v0.8.x) on the WordPress.org repository

Discovery Timeline

2026-06-24 - CVE-2026-9710 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-9710

Vulnerability Analysis

The vulnerability is an authenticated broken access control flaw [CWE-862] combined with sensitive information disclosure [CWE-200]. Cornerstone exposes a CSS-preview request handler used to render dynamic content tokens within the page builder. The handler does not validate whether the requesting user has the capability to manage content or to read arbitrary user data. The nonce protecting the endpoint is rendered into every wp-admin page served to authenticated users, making it accessible to subscribers and other low-privilege roles. By submitting crafted token expressions referencing other users, an attacker triggers token evaluation in the target user's context and receives the resulting values in the response.

Root Cause

The handler relies on nonce validation as its sole authorization control and omits a current_user_can() capability check. Because WordPress nonces verify request intent rather than authorization, any user able to read the nonce can invoke the endpoint. Distributing the nonce to all authenticated administrative views eliminates the practical barrier to abuse.

Attack Vector

An attacker authenticates to WordPress with any role that can access wp-admin, including subscriber. The attacker loads an admin page, extracts the embedded nonce, and issues a request to the CSS-preview handler. The request supplies dynamic content tokens that reference target user metadata such as user_pass, user_email, or other wp_usermeta keys. The handler evaluates the tokens against the specified user identifier and returns the rendered values, disclosing password hashes suitable for offline cracking with tools such as hashcat against WordPress phpass hashes.

No verified exploitation code is publicly available. Refer to the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-9710

Indicators of Compromise

POST or GET requests from low-privilege accounts to Cornerstone CSS-preview AJAX actions in admin-ajax.php containing dynamic content token parameters referencing user_pass, user_email, or wp_usermeta keys
Repeated requests from a single authenticated session iterating through sequential user IDs
Subscriber or contributor sessions issuing requests with the Cornerstone preview nonce shortly after logging into wp-admin

Detection Strategies

Inspect web server and WordPress access logs for action= parameters tied to Cornerstone preview handlers issued by non-administrator accounts
Enable WordPress audit logging to capture AJAX invocations with the requesting user role and the parameters submitted
Alert on response bodies returned from admin-ajax.php containing strings resembling phpass hashes ($P$, $wp$) being delivered to low-privilege sessions

Monitoring Recommendations

Forward WordPress and reverse-proxy logs into a centralized analytics platform for correlation across sessions and source IPs
Track creation of new low-privilege accounts followed by immediate wp-admin activity, a common precursor to abuse
Monitor outbound traffic from the WordPress host for unusual data egress that could indicate bulk hash extraction

How to Mitigate CVE-2026-9710

Immediate Actions Required

Update the Cornerstone plugin and the bundled X theme to a release containing Cornerstone 7.8.8 or later
Force password resets for all users, prioritizing administrators and editors, in case hashes were exfiltrated
Audit user accounts and remove unused or suspicious low-privilege registrations that could be staged for exploitation

Patch Information

Upgrade Cornerstone to version 7.8.8 or later, which enforces capability checks on the CSS-preview handler and removes broad exposure of the associated nonce. The patch is delivered through the Themeco update channel bundled with the X theme. Confirm the installed version under Themes and Plugins after updating. Consult the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict user registration and require administrator approval until patching is complete
Limit access to wp-admin by source IP using web server rules or a web application firewall
Temporarily disable the Cornerstone page builder on sites where it is not actively used for content editing

bash

# Restrict /wp-admin access by IP at the nginx layer
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}