CVE-2026-54185: WordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerability

Synopsis

SQL injection vulnerability in the WordPress Cornerstone plugin affects all versions below 7.8.8. The flaw is reachable over the network and requires only a low-privilege (subscriber-level) account to exploit, with no further user interaction needed. Successful exploitation gives an attacker read access to sensitive database contents across any site running the affected plugin, and can also partially disrupt service availability. A patched-image rebuild at version 7.8.8 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress site via HTTP/HTTPS.

• AuthenticationRequired

  A low-privilege account (subscriber-level or equivalent) is sufficient; no administrative access is needed.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; the injection can be triggered directly.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental factors required.

Blast Radius

• Reads arbitrary rows from the WordPress database, including stored user credentials, session tokens, private post content, and plugin configuration data.
• The scope extends beyond the vulnerable component itself (S:C), meaning data from other applications sharing the same database server may also be exposed.
• Partial disruption of service availability is possible, for example through resource-exhausting queries that slow or crash database responses.