CVE-2026-75027

Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action

View on CVE.org
Published Aug 22, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.

Analysis

AI-generated

Technical impact

The vulnerability arises from an omission of proper authorization checks in the Themify Builder AJAX endpoint tb_update_old_data, allowing any user to send a request with a valid nonce, an arbitrary post ID, and a JSON payload to alter the styling data of that post. This flaw lets attackers modify padding, margin, and other styling properties of any post, including private and draft content, effectively compromising the visual integrity of the site. The issue is a classic authorization bypass, classified as CWE-862.

Affected Systems

The affected product is the Themify Builder plugin for WordPress, all releases through version 7.8.0 inclusive.

Risk and Exploitability

With a CVSS score of 5.3, this vulnerability presents a moderate risk. The attack requires only an unauthenticated request to a web page, and because the necessary nonce is automatically exposed to the front‑end, the exploitation barrier is low. The EPSS score is not available, and the entry is not currently listed in CISA’s KEV catalog, but its public nature means a site not promptly patched remains at risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Themify Builder to any version newer than 7.8.0, which implements proper authorization checks for tb_update_old_data.
  • If an update cannot be applied immediately, block unauthenticated access to the AJAX endpoint tb_update_old_data using a web‑application firewall rule or by adding role checks in the plugin’s code.
  • Review existing post styling data for anomalies and restore or delete any content that has been altered without authorization.

Generated by OpenCVE AI on August 22, 2026 at 04:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.
Title Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Aug 24, 2026, 1:01 PM
Reserved
Aug 17, 2026, 2:54 PM

View source JSON

Updated
Aug 24, 2026, 12:53 PM

JSON

Status
Deferred
Published
Aug 22, 2026, 4:18 AM
Modified
Oct 12, 2026, 4:10 PM

View source JSON

No data.

Updated
Aug 22, 2026, 4:30 AM

JSON