CVE-2026-15407Disclosure

LOWCVSS 4.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite or delete the generated CSS stylesheet file of arbitrary posts, including private and draft posts owned by other users, and modify plugin-scoped font options. The required CSRF nonce (tf_nonce) is emitted on public front-end builder pages via wp_localize_script, making it trivially obtainable by any authenticated user visiting such a page.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-15407 The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly ver… https://www.cve.org/CVERecord?id=CVE-2026-15407 ----- Traducción: CVE-2026-15407 El … http://infoflow.cloud`
Post summary
The post announces CVE-2026-15407, stating that the Themify Builder plugin for WordPress is vulnerable to an authorization bypass in all versions up to 7.7.7.
0000039
92 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-15407 The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly ver… https://www.cve.org/CVERecord?id=CVE-2026-15407
Post summary
The statement announces an authorization bypass vulnerability (CVE-2026-15407) in the Themify Builder WordPress plugin, clarifying affected versions but providing no PoC, exploit code, or patch details.
00000377
57.8K followersView on X

Explore more

Back to dashboard