CVE-2026-7726: Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync() callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}) and to write the JSON-decoded responses verbatim into the site's wpoptions table via settransient() — at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Layouts for WPBakery (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.1.3 - Configuration
Remove or disable the unauthenticated Ajax handler for `handle_sync` by unregistering/deactivating the `wp_ajax_nopriv_handle_sync` callback so `Layouts_WPB_Remote::template_sync()` cannot be triggered by unauthenticated users.
WordPress (Ajax endpoint) wp_ajax_nopriv_handle_sync = disabled/removed - Compensating control
Restrict outbound connectivity from the WordPress server to the Layouts for WPBakery external API domain `www.layoutsforwpbakery.com` (or block it entirely) to limit the impact of forced outbound HTTP requests.