Authorization Bypass Vulnerability in Themify Builder Plugin for WordPress

CVE-2026-15407

What is CVE-2026-15407?

The Themify Builder plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 7.7.7. This issue arises from the plugin's failure to adequately verify user permissions, allowing authenticated users with subscriber-level access or higher to overwrite or delete generated CSS stylesheet files from any post, including private and draft ones belonging to other users. Additionally, this vulnerability enables the manipulation of plugin-specific font options. The public front-end pages of the builder emit a CSRF nonce, easily accessible to any authenticated user visiting such pages, exacerbating the risk of unauthorized actions.

References