What is the CVSS score of CVE-2026-15407?

CVE-2026-15407 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Themify Builder CVE-2026-15407

EUVD-2026-44891 MEDIUM

Missing Authorization (CWE-862)

2026-07-16 Wordfence

GHSA-f4cp-4p46-3f73

WordPress Authentication Bypass CSRF Themify Builder Wordpress Plugin Themifyme

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Subscriber-level authentication required (PR:L); nonce trivially obtained from public pages (AC:L); impact confined to CSS and font integrity with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 09:06 vuln.today

CVE Published

Jul 16, 2026 - 07:51 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite or delete the generated CSS stylesheet file of arbitrary posts, including private and draft posts owned by other users, and modify plugin-scoped font options. The required CSRF nonce (tf_nonce) is emitted on public front-end builder pages via wp_localize_script, making it trivially obtainable by any authenticated user visiting such a page.

AnalysisAI

Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-862 (Missing Authorization) within the Themify Builder WordPress page builder plugin (CPE: cpe:2.3:a:themifyme:themify_builder:*:*:*:*:*:*:*:*). The defective logic resides in class-themify-builder-stylesheet.php, confirmed across at least tags 7.7.5 and 7.7.7 via the plugin's Trac repository at lines 17, 69, 160, and 313. The stylesheet class handles dynamic CSS generation and font option management for builder-created posts. WordPress plugins are expected to call current_user_can() or equivalent capability checks before performing privileged write operations on post-owned resources; this plugin omits those checks. The tf_nonce CSRF token - the sole token protecting these endpoints - is injected into all public front-end builder pages via WordPress's wp_localize_script() function, meaning any authenticated user who loads such a page receives the nonce in the page's HTML, collapsing what should be a multi-layer control into a single, easily bypassed one.

RemediationAI

An upstream fix has been committed to the Themify Builder plugin repository, as evidenced by the changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3607906%40themify-builder&new=3607906%40themify-builder; however, the specific patched release version number is not independently confirmed from available data - administrators should update to the latest available version from the WordPress plugin repository and verify the installed version exceeds 7.7.7. As a compensating control while awaiting a confirmed patched release, site administrators should disable open user registration if not operationally required, as this eliminates the subscriber-level prerequisite for exploitation; note that this may break workflows relying on self-service registration. Additionally, restricting access to front-end builder pages to authenticated editors or above would prevent the trivial nonce harvesting path, though this trades usability for security. Monitoring for unexpected modifications to CSS stylesheets or font option changes in plugin logs may help detect active exploitation attempts.