Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107887— Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme

Quick assessment

Affected
Unknown Advanced Twenty Seventeen
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Advanced Twenty Seventeen WordPress 插件（1.3.1 及以下版本）在创建并激活其捆绑的子主题的操作中，未执行任何权限（capability）或一次性令牌（nonce）检查。这导致任何已认证用户（例如订阅者）均可将站点的活动全局主题切换为该子主题；此外，该操作还可通过跨站请求伪造（CSRF）攻击，针对任何已登录用户（包括管理员）被触发。

AI Predicted 7.8 Difficulty: Easy
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107887

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme
Source: CVE Program / CVE List V5
Vulnerability Description
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Advanced Twenty Seventeen 0 ~ 1.3.1 -

II. Public POCs for CVE-2026-107887

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107887

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-24 · 16 CVEs total

CVE-2026-114429 WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
CVE-2026-113673 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
CVE-2026-113493 GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
CVE-2026-112207 Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
CVE-2026-113489 GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
CVE-2026-113490 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup RE
CVE-2026-113492 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed
CVE-2026-113491 GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
CVE-2026-110956 asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
CVE-2026-105199 Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager
CVE-2026-87835 Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assig
CVE-2026-107907 MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist
CVE-2026-97352 News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via
CVE-2026-97353 News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_

IV. Related Vulnerabilities

Same vendor: Unknown

V. Comments for CVE-2026-107887

No comments yet

Leave a comment