Executive brief
Themify Builder is a popular WordPress plugin for creating and styling website content. An unauthenticated attacker can modify the visual styling (padding, margins, and other properties) of any WordPress post—including private and draft posts—without permission. The attacker can obtain a valid authentication token from any public page, bypassing the plugin's access controls entirely.
Technical details
The vulnerability is an authorization bypass in the Themify Builder plugin's styling handler, affecting versions up to 7.8.0. The root cause is insufficient authorization verification: the plugin fails to properly check whether a user has permission to modify post styling data before processing requests. Although the handler requires a nonce for CSRF protection, the nonce is automatically embedded in all frontend pages via wp_localize_script, allowing any unauthenticated visitor to extract a valid nonce from the page source. An attacker can then craft a request with an arbitrary post ID and JSON styling payload to modify stored builder data. Network reachability and the ability to view a public page are the only prerequisites; no prior authentication is required.
Affected products
- Themify Builder up to 7.8.0
Timeline
- 2026-08-22: disclosed