CVE-2026-75027: Themify Builder Auth Bypass Vulnerability

CVE-2026-75027 Overview

CVE-2026-75027 is an authorization bypass vulnerability in the Themify Builder plugin for WordPress affecting all versions up to and including 7.8.0. The plugin fails to properly verify that a user is authorized to perform an action before accepting styling updates. Unauthenticated attackers can modify stored Themify Builder styling data (padding and margin properties) on arbitrary posts, including private and draft posts. The handler relies on a nonce as its sole access control, but the nonce is emitted to every frontend page via wp_localize_script, allowing any visitor to retrieve it from page source. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can tamper with the styling data of any post, including unpublished private and draft content, degrading site integrity.

Affected Products

Themify Builder plugin for WordPress, all versions up to and including 7.8.0
WordPress sites rendering pages through the Themify Builder frontend
Sites exposing the builder's wp_localize_script-emitted nonce on public pages

Discovery Timeline

2026-08-22 - CVE-2026-75027 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-75027

Vulnerability Analysis

The vulnerability resides in the Themify Builder handler that processes stored styling data for posts. The handler accepts an attacker-controlled post ID and a JSON styling payload, then writes the supplied padding and margin properties into the post's builder metadata. No capability check confirms that the caller owns the post, has edit rights, or is even authenticated.

The only gate is a nonce check. That nonce is generated server-side and injected into frontend script data through wp_localize_script, so it appears in the HTML source of any page rendered by the builder. An unauthenticated visitor can request a public page, extract the nonce, and replay it against the AJAX endpoint with any post ID. Because the check validates only that the request originated with a valid nonce, and not that the caller has authority over the target post, arbitrary posts can be modified.

The integrity impact is limited to styling metadata, which aligns with the low integrity, no confidentiality, and no availability impact reflected in the CVSS score.

Root Cause

The root cause is a missing authorization check ([CWE-862]) in the styling save handler. The code path treats nonce validity as equivalent to authorization, conflating request forgery protection with access control. WordPress nonces are not designed to authorize actions on arbitrary objects; they exist to bind an action to a session. Without an accompanying current_user_can() capability check against the target post, any nonce holder can act on any post ID.

Attack Vector

The attack is remote and unauthenticated over the network. An attacker fetches any public page rendered by Themify Builder, parses the localized script data to retrieve the nonce, and issues a crafted AJAX POST containing the target post ID and a JSON payload defining padding and margin values. The server persists the styling data against the specified post, including posts in private or draft status. See the Wordfence Vulnerability Report and the Themify Builder Class Method source for the vulnerable handler.

No verified public exploit code is available. The vulnerability mechanism is documented in the vendor's plugin trac; see the Themify Builder Changeset Details for the remediation diff.

Detection Methods for CVE-2026-75027

Indicators of Compromise

Unexpected changes to padding or margin values in Themify Builder post metadata, particularly on private or draft posts
AJAX POST requests to Themify Builder endpoints from unauthenticated sessions carrying valid nonces and arbitrary post_id parameters
Edits to post styling records where the WordPress post_modified timestamp advances without a corresponding authenticated editor session

Detection Strategies

Review web server access logs for POST requests to admin-ajax.php referencing Themify Builder actions with varying post_id values from the same client
Compare current post styling metadata against known-good backups to identify unauthorized modifications
Alert on frontend clients that scrape pages then immediately issue AJAX POSTs with the extracted nonce value

Monitoring Recommendations

Enable WordPress audit logging to capture changes to post meta keys used by Themify Builder
Forward web server and WordPress audit events to a central SIEM for correlation of nonce reuse patterns across post IDs
Baseline normal builder activity per authenticated editor and alert on anomalous unauthenticated write attempts

How to Mitigate CVE-2026-75027

Immediate Actions Required

Upgrade the Themify Builder plugin to a version above 7.8.0 that includes the fix referenced in the plugin changeset
Audit private and draft posts for unexpected padding and margin changes and restore from backup where tampering is confirmed
Rotate any editorial workflows that assume draft styling reflects authorized author input

Patch Information

The vendor addressed the issue in the release following 7.8.0. Review the Themify Builder Stylesheet Class (v7.8.0) and the Themify Builder Class Implementation (v7.8.0) alongside the changeset diff to confirm the authorization check is present in your installed build.

Workarounds

Restrict access to admin-ajax.php Themify Builder actions at the web application firewall until the plugin is upgraded
Deactivate the Themify Builder plugin on sites that do not require frontend building until a patched version is deployed
Limit exposure of the builder-rendered pages to authenticated users where feasible to reduce nonce harvesting opportunities

bash

# Configuration example: WAF rule sketch to block unauthenticated Themify Builder save requests
# Adjust action name to match the specific handler in your installed version
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1002026750271,msg:'Block Themify Builder styling save from unauthenticated client'"
  SecRule ARGS:action "@rx ^themify_builder_(save|style)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"