Atomic Edge analysis of CVE-2026-49113 (metadata-based):
This vulnerability allows authenticated attackers with Subscriber-level access or higher to execute arbitrary code on the server. The affected component is the Cornerstone plugin for WordPress versions below 7.8.8. The CVSS 3.1 score is 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network exploitation, low complexity, low privileges required, no user interaction, and full compromise of confidentiality, integrity, and availability.
Root Cause: The vulnerability is classified as CWE-94: Improper Control of Generation of Code (Code Injection). Based on this classification and the description, Atomic Edge research infers that the plugin passes user-supplied input into an insecure `eval()`, `create_function()`, `call_user_func()`, or similar PHP code execution function without proper sanitization. This likely occurs in the plugin’s page builder or template rendering engine, where shortcodes, CSS/JS injections, or dynamic data binding features accept input from authenticated users and process it as executable code. Without source code access, Atomic Edge cannot confirm the exact vulnerable function, but the CWE suggests a direct code injection pattern where attacker-controlled strings are interpolated into PHP code constructs.
Exploitation: Atomic Edge analysis indicates the attack vector involves an authenticated Subscriber sending a crafted request to a WordPress AJAX endpoint or REST API route exposed by the Cornerstone plugin. The likely endpoint is `/wp-admin/admin-ajax.php` with an action parameter like `cornerstone_save`, `cornerstone_render`, or `cornerstone_load`. The attacker sends a POST request containing malicious PHP code (for example, `system(‘id’)` or `file_put_contents(‘/wp-content/uploads/shell.php’, ”)`) within a parameter that the plugin processes as a template or dynamic content value. The plugin then unsafely evaluates this input, executing the injected code on the server. No nonce bypass is required because the vulnerability exists even with valid authentication.
Remediation: The fix for CWE-94 code injection requires the plugin to replace all instances of dynamic code execution (eval, create_function, call_user_func with unsanitized input) with safe alternatives. The plugin should validate and sanitize any user-supplied data before processing it. If dynamic template rendering is necessary, the plugin should employ a sandboxed template engine (like Twig) that does not allow arbitrary PHP execution. Atomic Edge recommends upgrading to Cornerstone version 7.8.8 or higher, which contains the patch.
Impact: Successful exploitation gives an authenticated attacker with low privileges (Subscriber) the ability to execute arbitrary PHP code on the WordPress server. This leads to full site compromise: the attacker can access and modify the database, execute system commands, upload malicious files, create administrative users, and pivot to other applications on the same server. Data confidentiality is lost, integrity is compromised, and availability may be affected if the attacker corrupts the site or deletes critical files.
