Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Themify Builder plugin for WordPress allows unauthorized changes

CVE-2026-15407 · published 3 months ago
Summary

The Themify Builder plugin for WordPress, in versions up to 7.7.7, does not properly verify user permissions. This means that attackers with basic account access can make unauthorized changes to website content and settings, including deleting or modifying private posts and changing font options. To protect your website, update the plugin to the latest version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
themifyme themify builder <= 7.7.7
Original advisory text
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorize...
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite or delete the generated CSS stylesheet file of arbitrary posts, including private and draft posts owned by other users, and modify plugin-scoped font options. The required CSRF nonce (tf_nonce) is emitted on public front-end builder pages via wp_localize_script, making it trivially obtainable by any authenticated user visiting such a page.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published16 Jul 2026
Updated4 Nov 2026
First seen16 Jul 2026
Sources
CVE-2026-15407 · NVD
CVE-2026-15407 · MITRE
Track software like this
Free during beta