Is CVE-2026-9710 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9710 being exploited in the wild.

How severe is CVE-2026-9710?

Informational severity, with a CVSS score of 7.7, published 24 June 2026.

Is there a fix for CVE-2026-9710?

A patch was published on 2026-06-24: Fixed in version 7.8.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9710 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9710?

Check whether you run THEMECO Cornerstone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9710: Themeco Cornerstone sensitive data disclosure in CSS-preview handler

CVE-2026-9710 · Severity: info · CVSS 7.7 · Published 2026-06-24

The premium Cornerstone page builder plugin for WordPress, often bundled with the X Theme, contains a security flaw that allows any logged-in user, including those with low-level 'Subscriber' permissions, to access sensitive information. By exploiting a weakness in how the plugin handles CSS previews, an attacker can retrieve private data such as administrative password hashes and session tokens. This could lead to full account takeover and unauthorized access to the website's management interface.

Technologies: THEMECO Cornerstone. Vendors: THEMECO.

Quick answers

Is CVE-2026-9710 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9710 being exploited in the wild.
How severe is CVE-2026-9710?: Informational severity, with a CVSS score of 7.7, published 24 June 2026.
Which products and versions are affected?: THEMECO Cornerstone < 7.8.8.
Is there a fix for CVE-2026-9710?: A patch was published on 2026-06-24: Fixed in version 7.8.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9710 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9710?: Check whether you run THEMECO Cornerstone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the CSS-preview request handler of the premium Cornerstone page builder. The plugin fails to enforce proper capability checks and unconditionally exposes the required security nonce to all logged-in users on wp-admin pages. An authenticated attacker (Subscriber level or higher) can use this nonce to send a crafted POST request to the CSS preview endpoint. By utilizing dynamic content tokens (e.g., {{dc:user:meta}}), the attacker can evaluate and exfiltrate sensitive metadata from the database, including raw user password hashes (user_pass) and session tokens for arbitrary users, including administrators. This issue was fixed in version 7.8.8.

Affected products

Themeco Cornerstone (Premium) < 7.8.8

Timeline

2026-06-03: disclosed: Initial public disclosure by WPScan
2026-06-24: advisory: NVD publication date
2026-06-24: patched: Fixed in version 7.8.8

References

https://wpscan.com/vulnerability/4fc21e38-f2df-41be-86b7-a897483574bb/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.