CVE-2026-9709

Name of the Vulnerable Software and Affected Versions Cornerstone WordPress plugin versions prior to 7.8.9

Description The plugin fails to enforce capability checks on a REST API route, which allows any authenticated user to disclose metadata of other users. This exposed information includes user roles, session token previews, and stored billing or shipping fields. This issue specifically affects the premium Cornerstone page builder bundled with the X theme, and not the free version available on the .org repository.

Recommendations Update to version 7.8.9 or later.