Themify Builder CVE-2026-15407

Exploitation requires at minimum a valid subscriber-level authenticated session on the target WordPress site - unauthenticated exploitation is not possible, confirmed by CVSS PR:L. The attacker must also be able to visit at least one public front-end builder page to retrieve the tf_nonce CSRF nonce emitted via wp_localize_script; if all builder pages require higher-privilege authentication, nonce harvesting becomes more constrained. No non-default server configuration is required beyond having the Themify Builder plugin active. Impact is bounded to CSS stylesheet file overwrite/delete and plugin-scoped font option modification - there is no code execution path and no direct data exfiltration. Sites with disabled user registration or no subscriber-level accounts in their user base are not exploitable via this path.

The NVD-assigned CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects the bounded impact: no confidentiality or availability consequence, integrity impact limited to CSS stylesheets and font settings, and a low-privilege authentication requirement that excludes unauthenticated exploitation. Real-world risk is elevated for sites with open user registration, where any registered visitor qualifies as a subscriber and could immediately exploit the flaw. The attack complexity is genuinely low because the required nonce is available on any public builder page - no race condition, no complex precondition. The absence of a KEV listing and the lack of any identified public exploit keep this from being a priority-one response item, but the combination of a large WordPress install base, low exploitation complexity, and the ability to tamper with private/draft post styling (potentially leaking post existence or causing content disruption) warrants prompt patching. EPSS data was not provided in the source intelligence; exploitation probability is therefore inferred rather than quantified.

An attacker registers a free subscriber account on a target WordPress site running Themify Builder 7.7.7 or earlier, then visits any publicly accessible front-end builder page and extracts the tf_nonce value injected by wp_localize_script into the page JavaScript. Using that nonce, the attacker issues crafted HTTP POST requests to the plugin's stylesheet endpoints, deleting or overwriting CSS files for private draft posts authored by other users or altering site-wide font settings, causing visual defacement without triggering any capability check. No public exploit code has been identified at time of analysis, but the attack requires only standard browser developer tools to execute.