# CVE-2026-49113: THEMECO Cornerstone code injection allows arbitrary code execution

Source: https://junglewise.ai/threats/cve-2026-49113-themeco-cornerstone-code-injection-allows-arbitrary-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-49113 · Severity: high · CVSS 8.5 · Published 2026-06-17

Cornerstone, a popular page builder plugin for WordPress, contains a security flaw that allows users with low-level 'Subscriber' accounts to execute arbitrary code on the server. This could lead to a complete takeover of the website, unauthorized access to sensitive data, or the installation of malware. Site administrators should update the plugin immediately to prevent potential mass-exploitation campaigns.

Technologies: [THEMECO Cornerstone](https://junglewise.ai/threats/technologies/cornerstone). Vendors: [THEMECO](https://junglewise.ai/threats/vendors/themeco).

## Quick answers

**Is CVE-2026-49113 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49113 being exploited in the wild.

**How severe is CVE-2026-49113?** High severity, with a CVSS score of 8.5, published 17 June 2026.

**Which products and versions are affected?** THEMECO Cornerstone < 7.8.8.

**Is there a fix for CVE-2026-49113?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49113 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49113?** Check whether you run THEMECO Cornerstone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability (CWE-94) exists in the THEMECO Cornerstone plugin for WordPress in versions prior to 7.8.8. The flaw allows an authenticated attacker with Subscriber-level permissions to execute arbitrary code on the hosting server. While the attack requires network access and a valid low-privilege account, the impact is high as it can lead to full system compromise and bypasses security boundaries (Scope: Changed). The vulnerability was addressed in version 7.8.8.

## Affected products

- THEMECO Cornerstone < 7.8.8

## Timeline

- 2026-04-23: other: Reported by Nguyen Ba Khanh
- 2026-06-04: advisory: Initial disclosure by Patchstack
- 2026-06-17: disclosed: NVD publication date

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/cornerstone/vulnerability/wordpress-cornerstone-plugin-7-8-8-arbitrary-code-execution-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/cornerstone/vulnerability/wordpress-cornerstone-plugin-7-8-8-arbitrary-code-execution-vulnerability?_s_id=cve)

## Related threats

- [Themeco Cornerstone sensitive data disclosure in CSS-preview handler](https://junglewise.ai/threats/cve-2026-9710-themeco-cornerstone-sensitive-data-disclosure-in-css-preview)
- [Themeco Cornerstone information disclosure in REST API](https://junglewise.ai/threats/cve-2026-9709-themeco-cornerstone-information-disclosure-in-rest-api)
- [Themeco Cornerstone SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-54185-themeco-cornerstone-sql-injection-in-wordpress-plugin)