Subscriber Arbitrary Code Execution in Cornerstone

Executive Summary

The WordPress Cornerstone Plugin versions below 7.8.8 contain a vulnerability that allows attackers to execute arbitrary code remotely on affected websites.

This means an attacker can run malicious code on your site without authorization, potentially compromising the entire system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to severe security risks including unauthorized control over your website.

• Attackers can remotely execute malicious code.
• It can result in mass-exploit campaigns affecting thousands of sites.
• Potential full compromise of website integrity, confidentiality, and availability.

Immediate action such as updating the plugin to version 7.8.8 or later is required to mitigate these risks.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WordPress Cornerstone Plugin to version 7.8.8 or later.

If updating the plugin is not possible immediately, users should seek assistance from their hosting provider or web developer.

Additionally, Patchstack has provided a mitigation rule to block attacks targeting this vulnerability until the plugin can be updated.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability affects WordPress Cornerstone Plugin versions below 7.8.8 and allows remote arbitrary code execution. Detection involves verifying the plugin version installed on your system.

To detect if your system is vulnerable, check the installed version of the Cornerstone plugin. For example, if you have command line access to the WordPress installation, you can run commands to inspect the plugin version.

• Navigate to the WordPress plugins directory, typically wp-content/plugins/cornerstone.
• Check the version in the plugin's main PHP file (usually cornerstone.php) by looking for the Version header, e.g., using: grep 'Version' cornerstone.php
• Alternatively, use WP-CLI to check the plugin version: wp plugin get cornerstone --field=version

If the version is below 7.8.8, your system is vulnerable and immediate update or mitigation is recommended.

Patchstack has provided a mitigation rule to block attacks until the plugin is updated, so applying such rules on your web application firewall or intrusion prevention system can help detect or block exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote attackers to execute arbitrary code on affected websites, which can lead to unauthorized access, data breaches, and potential compromise of sensitive information.

Such security breaches can impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and cyberattacks.

Therefore, failing to address this vulnerability in the Cornerstone plugin could result in non-compliance with these regulations due to increased risk of data exposure and security incidents.

Useful 0 Not Useful 0