# CVE-2026-9709: Themeco Cornerstone information disclosure in REST API

Source: https://junglewise.ai/threats/cve-2026-9709-themeco-cornerstone-information-disclosure-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-9709 · Severity: info · CVSS 7.7 · Published 2026-06-24

The premium Cornerstone page builder plugin for WordPress, often bundled with the X Theme, contains a security flaw that allows any registered user to view sensitive information about other users. This includes private data such as user roles, session token fragments, and personal billing or shipping addresses. An attacker with a basic account could use this to gather intelligence for further attacks or compromise customer privacy.

Technologies: [THEMECO Cornerstone](https://junglewise.ai/threats/technologies/cornerstone). Vendors: [THEMECO](https://junglewise.ai/threats/vendors/themeco).

## Quick answers

**Is CVE-2026-9709 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9709 being exploited in the wild.

**How severe is CVE-2026-9709?** Informational severity, with a CVSS score of 7.7, published 24 June 2026.

**Which products and versions are affected?** THEMECO Cornerstone < 7.8.9.

**Is there a fix for CVE-2026-9709?** A patch was published on 2026-06-24: Fixed in version 7.8.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9709 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9709?** Check whether you run THEMECO Cornerstone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Cornerstone plugin (specifically the premium version bundled with X Theme) lacks proper authorization checks on the '/themeco/data/dynamic-choices' REST API endpoint. An authenticated attacker with Subscriber-level privileges or higher can send a crafted, base64-encoded and gzipped JSON payload to this route to query user metadata. The vulnerability allows for the disclosure of sensitive 'usermeta' fields, including serialized capabilities (roles), session token prefixes, and WooCommerce billing/shipping information. While the returned metadata values are truncated to approximately 55 characters, they provide sufficient information for privilege escalation research or PII exposure. This issue is fixed in version 7.8.9.

## Affected products

- Themeco Cornerstone (Premium) < 7.8.9

## Timeline

- 2026-06-03: disclosed: Initial public disclosure by WPScan
- 2026-06-24: advisory: NVD publication date
- 2026-06-24: patched: Fixed in version 7.8.9

## References

- [https://wpscan.com/vulnerability/3ade0e4e-2070-4d3b-8f31-0d446839efd0/](https://wpscan.com/vulnerability/3ade0e4e-2070-4d3b-8f31-0d446839efd0/)

## Related threats

- [Themeco Cornerstone sensitive data disclosure in CSS-preview handler](https://junglewise.ai/threats/cve-2026-9710-themeco-cornerstone-sensitive-data-disclosure-in-css-preview)
- [Themeco Cornerstone SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-54185-themeco-cornerstone-sql-injection-in-wordpress-plugin)
- [THEMECO Cornerstone code injection allows arbitrary code execution](https://junglewise.ai/threats/cve-2026-49113-themeco-cornerstone-code-injection-allows-arbitrary-code)