Themify Builder CVE-2026-75027

No special deployment configuration is required beyond having the Themify Builder plugin active and at least one page rendered by it publicly accessible. The plugin automatically injects the nonce into every frontend page it renders, so any unauthenticated visitor to any builder-rendered page acquires a usable token. Limiting factors: the write primitive is restricted to CSS layout properties (padding/margin) only - this cannot be leveraged for code execution, option injection, or stored XSS via this specific handler. Exploitation is also bounded to post IDs that exist on the site; draft and private post IDs must be guessed or enumerated, adding minor friction but not a meaningful barrier given sequential WordPress IDs. There is no per-post ownership check in the handler, so any existing post is a valid target. Authentication is confirmed not required per CVSS PR:N.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) accurately reflects the attack surface: zero authentication, zero complexity, fully network-accessible. However, the real-world impact ceiling is constrained - the only writable data is CSS layout properties (padding/margin) on posts, which does not enable code execution, credential theft, or content injection. The practical blast radius is visual defacement of page layouts, including private and draft posts whose IDs can be guessed or enumerated. EPSS data was not provided; given the mass-market WordPress attack ecosystem, exploitation probability is non-trivial once details are public. No CISA KEV listing means active exploitation is not yet confirmed. No POC code was referenced. The effective risk tier is moderate: high exploitability offset by low-impact, non-destructive write primitives. Security teams with Themify Builder deployments should prioritize the patch but need not treat this as a critical incident-response scenario unless post content tampering carries compliance implications for their specific deployment.

An unauthenticated attacker visits any public page of a Themify Builder-powered WordPress site, retrieves the valid nonce from the page's JavaScript source (injected by wp_localize_script), and submits an AJAX POST request to admin-ajax.php with an attacker-chosen post ID and a crafted JSON payload setting arbitrary padding/margin values. Because private and draft posts are not excluded by the handler, an attacker can also target unpublished content if they can guess or enumerate post IDs - a low-effort task given WordPress's sequential integer post IDs. No exploit code is publicly referenced, but the attack requires only a browser and basic HTTP tooling.