The vulnerability in Themify Builder versions up to 7.7.7 is an authorization bypass that permits any authenticated user with subscriber level privileges or higher to overwrite or delete the generated CSS stylesheet for any post, including private and draft posts owned by other users. The flaw exists because the plugin fails to verify the user’s permission before performing the write or delete operation. Once the attacker captures the CSRF nonce (tf_nonce) that the plugin exposes on public front‑end builder pages, they can invoke the tb_generate_on_fly AJAX action to replace or remove stylesheet files or alter plugin‑scoped font options.

The affected product is the Themify Builder plugin for WordPress by themifyme. All releases 7.7.7 and earlier are vulnerable. No other products or later versions of the plugin are impacted by this specific flaw.

The CVSS score of 4.3 indicates moderate impact. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely but possible. The vulnerability is not listed in CISA KEV, so no confirmed exploitation has been reported. An attacker would need an authenticated session and access to a public builder page to capture the CSRF nonce; subsequently, the attacker could replace or delete stylesheet files, potentially breaking site styling and affecting post appearance and visibility. The primary risk is to site integrity and consistency rather than confidentiality or availability.