CVE-2026-15407: Themify Builder Auth Bypass Vulnerability

CVE-2026-15407 Overview

CVE-2026-15407 is an authorization bypass vulnerability in the Themify Builder plugin for WordPress affecting all versions up to and including 7.7.7. The plugin fails to properly verify that a user is authorized to perform stylesheet and font-related actions. Authenticated attackers with subscriber-level access or above can overwrite or delete the generated CSS stylesheet file of arbitrary posts, including private and draft posts owned by other users. Attackers can also modify plugin-scoped font options. The required CSRF nonce (tf_nonce) is emitted on public front-end builder pages via wp_localize_script, making it trivially obtainable by any authenticated user. The vulnerability maps to [CWE-862: Missing Authorization].

Critical Impact
Low-privileged authenticated users can tamper with CSS assets tied to private or draft posts owned by other users and alter plugin font configuration, enabling site defacement and content integrity attacks.

Affected Products

Themify Builder plugin for WordPress, all versions up to and including 7.7.7
WordPress sites with active Themify Builder installations that allow subscriber or higher registration
Front-end builder pages that expose the tf_nonce via wp_localize_script

Discovery Timeline

2026-07-16 - CVE-2026-15407 published to the National Vulnerability Database
2026-07-16 - Last updated in the NVD database

Technical Details for CVE-2026-15407

Vulnerability Analysis

The vulnerability resides in the class-themify-builder-stylesheet.php handler that generates and manages per-post CSS stylesheet files. The plugin registers AJAX actions that write or delete generated CSS files and update font-related plugin options. These actions verify a CSRF nonce but do not enforce a capability check tied to the target post. As a result, any authenticated user who can reach a front-end builder page can retrieve the tf_nonce and invoke the handler against arbitrary post identifiers. The impact is limited to integrity of stylesheet artifacts and font options, with no direct read of post content or authentication bypass at the site level.

Root Cause

The root cause is missing authorization enforcement in the AJAX handlers referenced in the Themify Builder source at lines 17, 69, 160, and 313 of class-themify-builder-stylesheet.php. The handlers rely on nonce verification as a proxy for authorization but never call current_user_can() against the target post or a plugin-level capability. The tf_nonce is emitted on public builder pages through wp_localize_script, so any logged-in visitor can harvest it. See the Themify Builder Code Review (7.7.7) for the vulnerable code paths.

Attack Vector

An attacker registers or uses a subscriber-level account. They then load a front-end page rendered by Themify Builder and extract the tf_nonce from the localized script data. Using that nonce, the attacker issues an authenticated AJAX request referencing a target post ID owned by another user, including private or draft posts. The handler proceeds to overwrite or delete the generated CSS file or modify plugin-scoped font options. Repeated requests can disrupt site presentation and remove custom styling across multiple posts.

No verified proof-of-concept code has been published. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-15407

Indicators of Compromise

Unexpected modification or deletion timestamps on Themify-generated CSS files under the plugin's cache directory (typically wp-content/themify/)
POST requests to admin-ajax.php referencing Themify Builder stylesheet actions originating from subscriber accounts
Sudden changes to plugin-scoped font options in the WordPress wp_options table without a corresponding administrator action
Rendering anomalies or missing styles on private or draft posts belonging to editors and authors

Detection Strategies

Review web server access logs for authenticated admin-ajax.php requests carrying action parameters tied to Themify Builder stylesheet handlers
Compare current CSS artifacts under the Themify cache directory against known-good backups to identify unauthorized overwrites or deletions
Correlate low-privileged user session activity with writes to plugin option keys governing fonts

Monitoring Recommendations

Enable WordPress activity logging to record option changes and AJAX invocations by non-administrator accounts
Alert on file system changes within wp-content/themify/ outside expected editorial workflows
Track new subscriber registrations followed shortly by AJAX activity referencing builder endpoints

How to Mitigate CVE-2026-15407

Immediate Actions Required

Update Themify Builder to a version later than 7.7.7 once the vendor publishes a patched release addressing the missing authorization check
Disable open user registration or restrict the subscriber role if the site does not require public accounts
Audit existing subscriber-level accounts for signs of abuse and revoke any that are unnecessary
Restore any tampered CSS files from backup and verify plugin font option values against known-good configuration

Patch Information

The vendor has published changes tracked in the Themify Builder Changeset History. Administrators should apply the latest available Themify Builder release through the WordPress plugin updater and confirm the installed version is greater than 7.7.7.

Workarounds

Restrict access to front-end builder pages so that unauthenticated and low-privileged users cannot retrieve the tf_nonce
Deploy a web application firewall rule to block admin-ajax.php requests from subscriber accounts targeting Themify stylesheet actions
Temporarily deactivate the Themify Builder plugin on sites that do not rely on it for production content

bash

# Configuration example: disable open registration until patched
wp option update users_can_register 0
wp option update default_role subscriber
# List and audit subscriber accounts for suspicious activity
wp user list --role=subscriber --fields=ID,user_login,user_registered,user_email