What the vulnerability does
01Description
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync()` callback registered via `wp_ajax_nopriv_handle_sync` in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (`https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}`) and to write the JSON-decoded responses verbatim into the site's `wp_options` table via `set_transient()` — at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.
Explanation of Vulnerability in Simple Terms
02Summary
Layouts for WPBakery versions 1.1.3 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify site content and disrupt availability. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update to a version newer than 1.1.3 immediately.
What an attacker can do
03Attacker Capabilities
Modify or delete site content and layouts without authentication.
Potential impact on your site
04Site Impact
Attackers can alter or remove page layouts and content, disrupting site functionality and visitor experience.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 5, 2026
CVE published
