Cross-Site Request Forgery Flaw in Advanced Twenty Seventeen WordPress Plugin
CVE-2026-107887
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-107887?
The Advanced Twenty Seventeen WordPress plugin prior to version 1.3.1 lacks proper capability checks or nonce verification when creating and activating its bundled child. This vulnerability enables any authenticated user, including users with minimal privileges like subscribers, to change the site's active theme. Additionally, this flaw can be exploited to trigger theme modifications for any logged-in user, including those with administrative rights, creating potential pathways for unauthorized site manipulation.
Affected Version(s)
Advanced Twenty Seventeen 0 <= 1.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.