EUVD-2026-64210
GHSA-xr4w-xj24-7x9c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable AJAX endpoint with nonce freely available to unauthenticated visitors; write impact limited to styling metadata, no confidentiality or availability loss.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.
AnalysisAI
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows any visitor to overwrite padding and margin properties on arbitrary posts, including private and draft content. The root cause is CWE-862 (missing authorization): the AJAX handler performing style writes relies solely on a WordPress nonce for access control, but that nonce is automatically broadcast to every frontend page via wp_localize_script, making it freely retrievable by any anonymous visitor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special deployment configuration is required beyond having the Themify Builder plugin active and at least one page rendered by it publicly accessible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) accurately reflects the attack surface: zero authentication, zero complexity, fully network-accessible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker visits any public page of a Themify Builder-powered WordPress site, retrieves the valid nonce from the page's JavaScript source (injected by wp_localize_script), and submits an AJAX POST request to admin-ajax.php with an attacker-chosen post ID and a crafted JSON payload setting arbitrary padding/margin values. Because private and draft posts are not excluded by the handler, an attacker can also target unpublished content if they can guess or enumerate post IDs - a low-effort task given WordPress's sequential integer post IDs. … |
| Remediation | The WordPress Plugin Trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3653841%40themify-builder&new=3653841%40themify-builder indicates an upstream fix has been committed; however, a specific patched release version is not confirmed in the available data - verify the latest plugin version in the WordPress.org repository and update to any release beyond 7.8.0 that incorporates this changeset. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Themify Builder
View allReflected cross-site scripting in the Themify Builder WordPress plugin (versions up to and including 7.7.4) lets remote
Stored XSS in the Themify Builder WordPress plugin (all versions through 7.7.6) allows contributor-level authenticated u
Stored Cross-Site Scripting in the Themify Builder WordPress plugin (all versions through 7.7.6) enables authenticated a
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subs
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today