CVE-2026-107887: Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the theme change?
Any authenticated WordPress user, including a subscriber-level account, can invoke the vulnerable action. The action can also be triggered through CSRF against any logged-in user, including an administrator.
What is the impact of successful exploitation?
An attacker can create and activate the plugin's bundled child theme, changing the site's active theme site-wide.
Is administrator access required to exploit this issue?
No. The affected action lacks a capability check, so a low-privileged authenticated user such as a subscriber can trigger it.
What protections are missing from the affected action?
The action does not perform capability validation or nonce validation. The missing nonce check also enables CSRF attacks against logged-in users.