CVE-2026-15407

Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.7.8

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can overwrite or delete generated CSS stylesheet files for arbitrary posts, including private and draft posts belonging to other users, and modify plugin-scoped font options. This is facilitated by the tf nonce CSRF nonce, which is exposed on public front-end builder pages via wp localize script, allowing any authenticated user to obtain it.

Recommendations Update Themify Builder to version 7.7.8 or later.