Description
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync()` callback registered via `wp_ajax_nopriv_handle_sync` in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (`https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}`) and to write the JSON-decoded responses verbatim into the site's `wp_options` table via `set_transient()` — at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.
Published: 2026-08-05
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Layouts for WPBakery plugin allows unauthenticated users to call the "handle_sync" AJAX action, which triggers a server‑side request to the plugin vendor’s external API. The response is then written verbatim to the WordPress options table using set_transient with no nonce, capability check, or rate limiting. This permits an attacker to alter the plugin’s cached data, potentially injecting or corrupting template information, thereby compromising data integrity.

Affected Systems

WordPress sites running the Layouts for WPBakery plugin up to and including version 1.1.3 are affected. No specific patch version is listed beyond the latest 1.1.3 release.

Risk and Exploitability

The vulnerability has a CVSS score of 6.5, indicating moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack can be launched by any unauthenticated user with network access to the target site, exploiting the wp_ajax_nopriv_handle_sync endpoint with no additional credentials or elevated privileges.

Generated by OpenCVE AI on August 5, 2026 at 08:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Layouts for WPBakery to the latest version that includes the fixed capability checks
  • If an upgrade is not immediately possible, remove or disable the "handle_sync" AJAX action by setting the appropriate filters or modifying the plugin’s code; alternatively, ensure the site blocks that endpoint for anonymous users
  • If the vulnerability cannot be remedied in short order, delete the cached options in wp_options by using WP‑CLI or phpMyAdmin to clear transients related to layoutsforwpbakery and restrict API access to trusted users

Generated by OpenCVE AI on August 5, 2026 at 08:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Techeshta
Techeshta layouts For Wpbakery
Wordpress
Wordpress wordpress
Vendors & Products Techeshta
Techeshta layouts For Wpbakery
Wordpress
Wordpress wordpress

Wed, 05 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync()` callback registered via `wp_ajax_nopriv_handle_sync` in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (`https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}`) and to write the JSON-decoded responses verbatim into the site's `wp_options` table via `set_transient()` — at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.
Title Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Techeshta Layouts For Wpbakery
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-05T14:13:46.740Z

Reserved: 2026-05-03T15:46:48.572Z

Link: CVE-2026-7726

cve-icon Vulnrichment

Updated: 2026-08-05T14:13:41.557Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:18:21Z

Weaknesses