CVE-2026-15407: Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite or delete the generated CSS stylesheet file of arbitrary posts, including private and draft posts owned by other users, and modify plugin-scoped font options. The required CSRF nonce (tfnonce) is emitted on public front-end builder pages via wplocalizescript, making it trivially obtainable by any authenticated user visiting such a page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/themify-builderto a version that resolves this vulnerability.Fixed in 7.7.7 - Configuration
Ensure the tb_generate_on_fly AJAX handler properly verifies that the requester is authorized to perform the requested action on the targeted post (not just that they are authenticated).
Themify Builder plugin (WordPress) Authorization checks for AJAX action tb_generate_on_fly = Verify user capabilities on every request (including subscriber+) before allowing any stylesheet write/delete for arbitrary post IDs. - Compensating control
Restrict access to Themify Builder public front-end builder pages (where tf_nonce is emitted via wp_localize_script) so that only trusted authenticated users can reach them.
- Operational
After remediation, review generated CSS stylesheet files and plugin-scoped font options for unauthorized changes, and restore any stylesheet modifications affecting private/draft posts owned by other users.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15407?
CVE-2026-15407 has a medium severity rating of 4.3.
How do I fix CVE-2026-15407?
To fix CVE-2026-15407, update the Themify Builder plugin to version 7.7.8 or later.
What type of vulnerability is CVE-2026-15407?
CVE-2026-15407 is an authorization bypass vulnerability.
Who is affected by CVE-2026-15407?
Authenticated users with subscriber-level access are affected by CVE-2026-15407.
What does CVE-2026-15407 allow attackers to do?
CVE-2026-15407 allows attackers to arbitrarily write or delete post stylesheets.