Description

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-22T04:18:15.057Z",
  "pubdate": "2026-08-22T04:18:15.057Z",
  "executiveSummary": "The Themify Builder plugin for WordPress, in all versions up to and including 7.8.0, is affected by an authorization bypass vulnerability.\nThe security flaw stems from inadequate privilege verification within the plugin's action handler, allowing unauthenticated attackers to modify stored Themify Builder styling data, specifically padding and margin properties.\nThe impact includes unauthorized modification of styling data for arbitrary posts, encompassing private and draft posts, by supplying an attacker-controlled post ID and a JSON styling payload.\nRisk implications are significant as unauthorized users can tamper with layout presentations across accessible posts.\nAttacker capabilities require no authentication to initiate the exploit.\nExploitation requirements are minimal, relying on an unauthenticated visitor retrieving a valid nonce automatically emitted to all frontend pages via wp_localize_script to satisfy the sole access control mechanism.",
  "technicalDetails": "The root cause of the vulnerability lies in the Themify Builder plugin's failure to properly verify whether a requesting user possesses the requisite authorization to perform state-changing actions.\nThe affected component handles AJAX or request processing related to Themify Builder styling data across all versions up to and including 7.8.0.\nAuthentication requirements are absent, meaning attackers operate entirely unauthenticated over the network.\nPrivilege requirements are nonexistent since the application fails to enforce capability checks such as edit_posts.\nNetwork exposure is fully public, as the targeted handlers are accessible via standard web requests.\nThe security mechanism implemented to protect the handler relies exclusively on a cryptographic nonce generated via wp_localize_script and emitted directly to the source code of all frontend pages rendered by the builder.\nAttack flow and exploitation occur in a sequential manner: First, an unauthenticated visitor browses any frontend page rendered by the builder and inspects the page source to trivially harvest the automatically exposed nonce.\nSecond, the attacker crafts a malicious HTTP request directed at the vulnerable handler, incorporating the harvested valid nonce to satisfy the weak access control check.\nThird, the attacker injects an attacker-controlled post ID alongside a malicious JSON styling payload containing altered padding and margin properties.\nPayload behavior results in the overwriting of stored styling data for the targeted post identifier.\nPost-exploitation impact encompasses unauthorized structural and aesthetic defacement or corruption of arbitrary posts, including unpublished private and draft posts within the WordPress database."
}