CVE-2026-9709 describes an information exposure vulnerability in the premium Cornerstone WordPress plugin (version 3.0.0 specifically noted) where a REST API route lacks proper capability enforcement. This allows authenticated users to retrieve sensitive metadata about other users, such as roles, session token previews, and billing/shipping fields. The vulnerability does not affect the free Cornerstone plugin available on WordPress.org. No CVSS score or official remediation level is currently provided, and no patch or fix links are available in the data.

Authenticated users can disclose sensitive metadata of other users, including roles and session token previews, which could aid in further attacks or unauthorized access. Exposure of billing and shipping fields may also lead to privacy violations or data leakage. However, exploitation requires authentication, limiting the attack surface to users with some level of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious activity. Avoid using affected versions in production environments if possible.