Executive brief
The premium Cornerstone page builder plugin for WordPress, often bundled with the X Theme, contains a security flaw that allows any logged-in user, including those with low-level 'Subscriber' permissions, to access sensitive information. By exploiting a weakness in how the plugin handles CSS previews, an attacker can retrieve private data such as administrative password hashes and session tokens. This could lead to full account takeover and unauthorized access to the website's management interface.
Technical details
The vulnerability exists in the CSS-preview request handler of the premium Cornerstone page builder. The plugin fails to enforce proper capability checks and unconditionally exposes the required security nonce to all logged-in users on wp-admin pages. An authenticated attacker (Subscriber level or higher) can use this nonce to send a crafted POST request to the CSS preview endpoint. By utilizing dynamic content tokens (e.g., {{dc:user:meta}}), the attacker can evaluate and exfiltrate sensitive metadata from the database, including raw user password hashes (user_pass) and session tokens for arbitrary users, including administrators. This issue was fixed in version 7.8.8.
Affected products
- Themeco Cornerstone (Premium) < 7.8.8
Timeline
- 2026-06-03: disclosed: Initial public disclosure by WPScan
- 2026-06-24: advisory: NVD publication date
- 2026-06-24: patched: Fixed in version 7.8.8