Is CVE-2026-49113 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49113 being exploited in the wild.

How severe is CVE-2026-49113?

High severity, with a CVSS score of 8.5, published 17 June 2026.

Is there a fix for CVE-2026-49113?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-49113 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49113?

Check whether you run THEMECO Cornerstone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49113: THEMECO Cornerstone code injection allows arbitrary code execution

CVE-2026-49113 · Severity: high · CVSS 8.5 · Published 2026-06-17

Cornerstone, a popular page builder plugin for WordPress, contains a security flaw that allows users with low-level 'Subscriber' accounts to execute arbitrary code on the server. This could lead to a complete takeover of the website, unauthorized access to sensitive data, or the installation of malware. Site administrators should update the plugin immediately to prevent potential mass-exploitation campaigns.

Technologies: THEMECO Cornerstone. Vendors: THEMECO.

Quick answers

Is CVE-2026-49113 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49113 being exploited in the wild.
How severe is CVE-2026-49113?: High severity, with a CVSS score of 8.5, published 17 June 2026.
Which products and versions are affected?: THEMECO Cornerstone < 7.8.8.
Is there a fix for CVE-2026-49113?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-49113 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49113?: Check whether you run THEMECO Cornerstone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability (CWE-94) exists in the THEMECO Cornerstone plugin for WordPress in versions prior to 7.8.8. The flaw allows an authenticated attacker with Subscriber-level permissions to execute arbitrary code on the hosting server. While the attack requires network access and a valid low-privilege account, the impact is high as it can lead to full system compromise and bypasses security boundaries (Scope: Changed). The vulnerability was addressed in version 7.8.8.

Affected products

THEMECO Cornerstone < 7.8.8

Timeline

2026-04-23: other: Reported by Nguyen Ba Khanh
2026-06-04: advisory: Initial disclosure by Patchstack
2026-06-17: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.