What the vulnerability does
01Description
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite or delete the generated CSS stylesheet file of arbitrary posts, including private and draft posts owned by other users, and modify plugin-scoped font options. The required CSRF nonce (tf_nonce) is emitted on public front-end builder pages via wp_localize_script, making it trivially obtainable by any authenticated user visiting such a page.
Explanation of Vulnerability in Simple Terms
02Summary
Themify Builder versions 7.7.7 and earlier lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can alter data through the builder interface without proper permission validation. This affects the integrity of site content but does not expose sensitive information or cause service disruption.
What an attacker can do
03Attacker Capabilities
Modify or alter site content and settings without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can alter page content, potentially defacing or corrupting your site's published material.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
July 16, 2026
CVE published
July 18, 2026
Record updated
