Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure

An attacker who is authenticated as any WordPress user (e.g., a subscriber) can send a crafted REST API request to the vulnerable route. The route does not verify that the requester has permission to view the target user's metadata. By supplying a different user ID, the attacker can retrieve sensitive data such as user roles, session token previews, and stored billing/shipping fields [ref_id=1]. No special privileges or network position beyond standard WordPress authentication are required.

The premium Themeco Cornerstone page builder (bundled with the X Theme) before version 7.8.9 fails to enforce capability checks on one of its REST API routes. This allows any authenticated user to query the metadata of any other user via that unprotected endpoint.

The advisory states the fix is included in version 7.8.9 of the premium Cornerstone plugin [ref_id=1]. The patch adds a capability check to the vulnerable REST API route, ensuring that only users with the appropriate permissions can access another user's metadata. Without this check, any authenticated user could enumerate arbitrary user meta.