CVE-2026-7726: Layouts for WPBakery Auth Bypass Flaw

CVE-2026-7726 Overview

CVE-2026-7726 is a missing authorization vulnerability [CWE-862] in the Layouts for WPBakery plugin for WordPress. The flaw affects all versions up to and including 1.1.3. The Layouts_WPB_Remote::template_sync() callback is registered via wp_ajax_nopriv_handle_sync, exposing it to unauthenticated requests without a capability check, nonce verification, or rate limiting.

Unauthenticated attackers can force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API at https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}. The server then writes the JSON-decoded responses verbatim into the site's wp_options table via set_transient().

Critical Impact
Unauthenticated attackers can trigger arbitrary outbound HTTP calls from vulnerable WordPress servers and write attacker-influenced data into the site's wp_options table without rate limiting.

Affected Products

Layouts for WPBakery plugin for WordPress
All versions up to and including 1.1.3
WordPress sites with the plugin activated

Discovery Timeline

2026-08-05 - CVE-2026-7726 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-7726

Vulnerability Analysis

The vulnerability originates in the plugin's AJAX handler registration. The template_sync() method is exposed through the wp_ajax_nopriv_handle_sync action hook, which WordPress dispatches for unauthenticated visitors. The callback performs no current_user_can() capability check and no check_ajax_referer() nonce validation.

When invoked, the handler issues outbound HTTP requests to the plugin vendor's REST endpoints for templates and categories. The response body is JSON-decoded and stored directly through set_transient(), which persists the value in the wp_options table. Attackers control the request frequency because no rate limiting is applied.

The issue is categorized as CWE-862: Missing Authorization. Impact includes low integrity loss from writing attacker-triggered data into site options and low availability loss from server-side request amplification against the vendor API or the WordPress host itself.

Root Cause

The root cause is the registration of a state-changing operation under wp_ajax_nopriv_* without any authorization or request-origin controls. The developer treated the sync routine as a low-privilege maintenance action, yet the callback writes to persistent storage and initiates outbound network traffic.

Attack Vector

An attacker sends crafted HTTP POST requests to /wp-admin/admin-ajax.php with the action parameter set to handle_sync. No authentication, cookies, or nonces are required. Each request forces the server to fetch the vendor API and overwrite the associated transient. Repeated requests can be used to induce load, poison cached template data, or consume outbound bandwidth. See the Wordfence Vulnerability Report and the WordPress API Code Reference for the affected callback.

Detection Methods for CVE-2026-7726

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php with action=handle_sync in web server access logs
Unexpected outbound HTTP requests from the WordPress host to www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/templates or /categories
Frequent updates to _transient_* rows tied to the Layouts for WPBakery plugin in the wp_options table
Presence of the vulnerable plugin at version 1.1.3 or earlier

Detection Strategies

Parse HTTP access logs for the action=handle_sync parameter originating from unauthenticated sources
Correlate inbound admin-ajax requests with outbound connections to the plugin vendor domain
Alert on high-frequency writes to WordPress transient options associated with the plugin

Monitoring Recommendations

Enable WordPress activity logging for AJAX endpoints and option table changes
Forward web server and WordPress logs to a centralized SIEM for correlation
Baseline outbound HTTP traffic from WordPress hosts and alert on deviations tied to the plugin's vendor API

How to Mitigate CVE-2026-7726

Immediate Actions Required

Update the Layouts for WPBakery plugin to a version later than 1.1.3 once released, per the WordPress Plugin Change Log
Deactivate and remove the plugin from any site that does not actively require it
Review the wp_options table for unexpected transient entries created by the plugin

Patch Information

The plugin maintainers committed a fix in the WordPress Plugin Change Log. Site administrators should apply the latest available release from the WordPress Plugin Overview page. Confirm the installed version is greater than 1.1.3 after upgrade.

Workarounds

Block unauthenticated requests to /wp-admin/admin-ajax.php where action=handle_sync at the web application firewall
Apply rate limiting on admin-ajax.php to reduce request amplification against the vendor API
Restrict outbound HTTP requests from the WordPress host to only trusted destinations
Disable the plugin until a patched version is installed

bash

# Example WAF rule (ModSecurity) to block the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026772601,msg:'Block CVE-2026-7726 handle_sync'"
  SecRule ARGS:action "@streq handle_sync" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"