Executive Summary

The vulnerability exists in the Themeco Cornerstone WordPress plugin versions prior to 7.8.9, which is the premium version bundled with the X Theme. It occurs because one of the plugin's REST API routes does not enforce proper capability checks.

This flaw allows any authenticated user, even those with minimal roles like Subscriber, to access and disclose metadata of any other user. The exposed metadata can include sensitive information such as user roles, session token previews, and stored billing or shipping details.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to sensitive data disclosure, allowing attackers with low-level access to retrieve private user information. This can compromise user privacy and security by exposing roles, session tokens, and billing or shipping information.

Such exposure could facilitate further attacks, including session hijacking or unauthorized actions performed under another user's identity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the vulnerable REST API route as an authenticated user with a low-level role such as Subscriber. The detection involves authenticating, obtaining a REST nonce, and sending a crafted request with a gzip+base64-encoded payload targeting a specific user to retrieve metadata.

A practical approach would be to use tools like curl or Postman to send requests to the REST API endpoint of the Themeco Cornerstone plugin prior to version 7.8.9, using an authenticated session of a Subscriber user.

• Authenticate as a Subscriber user to the WordPress site.
• Obtain a valid REST nonce for the session.
• Craft a gzip+base64-encoded payload targeting a specific user ID.
• Send a POST request to the vulnerable REST API endpoint with the payload.

Example curl command structure (replace placeholders accordingly):

• curl -X POST https://example.com/wp-json/cornerstone/v1/users/metadata -H "X-WP-Nonce: <nonce>" -H "Content-Type: application/json" -d '{"payload":"<gzip+base64-encoded-payload>"}' -b "wordpress_logged_in=<cookie>"

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and most effective mitigation step is to update the Themeco Cornerstone plugin to version 7.8.9 or later, where the vulnerability has been fixed.

If updating immediately is not possible, consider restricting access to the vulnerable REST API route by limiting authenticated user roles or applying firewall rules to block suspicious requests targeting the endpoint.

Additionally, monitor user activity for unusual access patterns and consider resetting session tokens or credentials if a compromise is suspected.

Useful 0 Not Useful 0