CVE-2026-75027: Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wplocalizescript, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the plugin so the 'tb_update_old_data' AJAX handler properly verifies the requester is authorized to modify the specified post before applying any styling changes.
Themify Builder (WordPress plugin) Authorization checks for AJAX action 'tb_update_old_data' = Require authenticated/authorized user before processing attacker-supplied post ID and JSON styling payload - Compensating control
Restrict access to any exposed Themify Builder admin/preview endpoints (and any network paths that can be used to reach the 'tb_update_old_data' AJAX handler) so unauthenticated users cannot interact with the handler.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote visitor can exploit it. A valid nonce is exposed on frontend pages rendered by Themify Builder, so no WordPress account or elevated role is required.
What data can an attacker modify?
An attacker can alter stored Themify Builder styling data for padding and margin properties. They can target arbitrary posts by providing a chosen post ID, including private posts and drafts.
Are sites affected by default?
Sites are exposed when frontend pages rendered by Themify Builder are accessible, because those pages automatically expose the nonce required by the vulnerable AJAX handler. The issue affects Themify Builder versions up to and including 7.8.0.