WordPress Cornerstone plugin < 7.8.8 - Arbitrary Code Execution vulnerability

Vulnerability

The vulnerability is an arbitrary code execution flaw in the WordPress Cornerstone plugin. According to Patchstack [1], versions prior to 7.8.8 are affected. However, the WordPress.org plugin repository lists the latest version as 0.8.1 and indicates the plugin is abandoned [2], meaning no patched version has been released. The vulnerability allows a subscriber-level user to execute arbitrary code.

Exploitation

An attacker needs a subscriber-level account on the WordPress site. The exact exploitation steps are not detailed in the references, but the vulnerability is classified as arbitrary code execution, suggesting the attacker can inject and execute PHP code via the plugin's functionality. The Patchstack advisory notes that this vulnerability is expected to be used in mass-exploit campaigns [1].

Impact

Successful exploitation allows an authenticated attacker with subscriber privileges to execute arbitrary code on the server, leading to full site compromise, data theft, or further attacks. The CVSS score is 8.5 (High) [1].

Mitigation

Patchstack recommends updating to version 7.8.8 or later [1]. However, the plugin appears abandoned on WordPress.org with no update since 2024 [2], so no official fix is available. Users should uninstall the plugin or replace it with an actively maintained alternative. Patchstack offers a mitigation rule to block attacks until an update is applied [1].