Description
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.
Published: 2026-08-22
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from an omission of proper authorization checks in the Themify Builder AJAX endpoint tb_update_old_data, allowing any user to send a request with a valid nonce, an arbitrary post ID, and a JSON payload to alter the styling data of that post. This flaw lets attackers modify padding, margin, and other styling properties of any post, including private and draft content, effectively compromising the visual integrity of the site. The issue is a classic authorization bypass, classified as CWE-862.

Affected Systems

The affected product is the Themify Builder plugin for WordPress, all releases through version 7.8.0 inclusive.

Risk and Exploitability

With a CVSS score of 5.3, this vulnerability presents a moderate risk. The attack requires only an unauthenticated request to a web page, and because the necessary nonce is automatically exposed to the front‑end, the exploitation barrier is low. The EPSS score is not available, and the entry is not currently listed in CISA’s KEV catalog, but its public nature means a site not promptly patched remains at risk.

Generated by OpenCVE AI on August 22, 2026 at 04:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Themify Builder to any version newer than 7.8.0, which implements proper authorization checks for tb_update_old_data.
  • If an update cannot be applied immediately, block unauthenticated access to the AJAX endpoint tb_update_old_data using a web‑application firewall rule or by adding role checks in the plugin’s code.
  • Review existing post styling data for anomalies and restore or delete any content that has been altered without authorization.

Generated by OpenCVE AI on August 22, 2026 at 04:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Description The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.
Title Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-22T03:37:47.994Z

Reserved: 2026-08-17T14:54:24.597Z

Link: CVE-2026-75027

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-22T04:18:15.057

Modified: 2026-08-22T04:18:15.057

Link: CVE-2026-75027

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T04:30:06Z

Weaknesses