CVE-2026-15407

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite or delete the generated CSS stylesheet file of arbitrary posts, including private and draft posts owned by other users, and modify plugin-scoped font options. The required CSRF nonce (tf_nonce) is emitted on public front-end builder pages via wp_localize_script, making it trivially obtainable by any authenticated user visiting such a page.

• CWE-862

• https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.5/classes/class-themify-builder-stylesheet.php#L160
• https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.5/classes/class-themify-builder-stylesheet.php#L17
• https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.5/classes/class-themify-builder-stylesheet.php#L313
• https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.5/classes/class-themify-builder-stylesheet.php#L69
• https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.7/classes/class-themify-builder-stylesheet.php#L160
• https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.7/classes/class-themify-builder-stylesheet.php#L17
• https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.7/classes/class-themify-builder-stylesheet.php#L313
• https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.7/classes/class-themify-builder-stylesheet.php#L69
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3607906%40themify-builder&new=3607906%40themify-builder
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b59e2773-31f0-4c19-b066-30982761bc44?source=cve

Published

Jul 16, 2026

Last Modified

Jul 18, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15395The Kali Forms — Contact Form & Drag-and-Drop Builder plugin…7.2
• CVE-2026-15397The Subscriptions for WooCommerce plugin for WordPress is vu…7.2
• CVE-2026-1540The Spam Protect for Contact Form 7 WordPress plugin before …7.2
• CVE-2026-15401The VikBooking Hotel Booking Engine & PMS plugin for WordPre…7.2
• CVE-2026-15403The Pinpoint Booking System – Version 2 plugin for WordPress…4.9
• CVE-2026-15404The Lpagery plugin for WordPress is vulnerable to Stored Cro…6.4
• CVE-2026-15409A Server-side request forgery (SSRF) vulnerability has been …10
• CVE-2026-1541The Avada (Fusion) Builder plugin for WordPress is vulnerabl…4.3
• CVE-2026-15410Post-authentication improper control of generation of code (…7.2
• CVE-2026-15411The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO,…5.3
• CVE-2026-15414The Subscriptions for WooCommerce plugin for WordPress is vu…8.8
• CVE-2026-15415AWS HealthOmics is a HIPAA-eligible service that fully manag…6.8