CVE-2026-49113: WordPress Cornerstone plugin < 7.8.8 - Arbitrary Code Execution vulnerability

Synopsis

An arbitrary code execution vulnerability affects the Cornerstone WordPress plugin in versions before 7.8.8. A remote attacker with a low-privilege (subscriber-level) account can reach the vulnerable endpoint over the network without requiring any victim interaction, exploiting a high-complexity condition to run arbitrary code on the server. Successful exploitation gives the attacker full read, write, and availability impact on the hosting environment, including data outside the WordPress installation itself. A patched-image rebuild at version 7.8.8 is available on HarborGuard for environments running an affected version of Cornerstone.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; the vulnerable endpoint is exposed via the standard HTTP interface.

• AuthenticationRequired

  A low-privilege account (subscriber-level or equivalent) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker exploits the endpoint directly without involving another authenticated user.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must meet specific environmental conditions or timing constraints, such as a particular server configuration or race condition, to succeed reliably.

Blast Radius

• The attacker executes arbitrary code under the web server process, gaining a foothold on the underlying host.
• Confidentiality impact is high: the attacker reads files, environment variables, database credentials, and session tokens accessible to the web process, including data outside the WordPress installation due to the changed scope.
• Integrity impact is high: the attacker writes or modifies files, database records, and configurations on the server.
• Availability impact is high: the attacker can crash or disable the WordPress application or consume host resources, taking the site offline.