Themify Builder <= 7.8.0 Missing Authorization Arbitrary Data Modification via AJAX (CVE-2026-75027)

Vulnerability Overview Vulnerability Name: Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action CVE ID: CVE-2026-75027 CVSS Score: 5.3 (Medium) Publication Date: August 21, 2026 Last Updated: August 22, 2026 Researchers: Wordfence PRISM - Wordfence Affected Software Software Type: Plugin Software Name: Themify Builder Affected Versions: <= 7.8.0 Fixed Versions: 7.8.1 Remediation Recommendation: Update to version 7.8.1 or later patched versions. Vulnerability Description The Themify Builder plugin contains an authorization bypass vulnerability that allows unauthenticated attackers to modify stored Themify Builder style data (including padding and margin properties). The vulnerability is exploited by providing an attacker-controlled post ID and a JSON style payload, leveraging the fact that automatically sends data to all frontend pages, thereby bypassing nonce validation. References plugins.trac.wordpress.org Additional Information Share Options: Facebook, Twitter, LinkedIn, Email Recent Vulnerabilities Themify Builder <= 7.7.7: Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action Themify Builder <= 7.7.6: Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module tb_width_map Field Themify Builder <= 7.7.6: Authenticated (Contributor+) Stored Cross-Site Scripting via height_slider Slider Module Field Themify Builder <= 7.7.4: Unauthenticated Stored Cross-Site Scripting Themify Builder <= 7.6.9: Authenticated (Contributor+) Stored Cross-Site Scripting Themify Builder <= 7.6.7: Missing Authorization Themify Builder <= 7.6.5: Reflected Cross-Site Scripting Themify Builder <= 7.6.3: Authenticated (Contributor+) Local File Inclusion Themify Builder <= 7.6.5: Authenticated (Contributor+) Stored Cross-Site Scripting Themify Builder <= 7.6.2: Reflected Cross-Site Scripting Copyright Information Copyright: 2012-2026 Defiant Inc. License: Used in accordance with the Common Vulnerabilities and Exposures (CVE) license from MITRE Corporation. Contact Information Contact Email: wfi-support@wordfence.com Business Hours Support Hours: 9am-6pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Additional Links Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Social Media Facebook: Link Twitter: Link LinkedIn: Link Instagram: Link Products and Services Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscription Subscription Form: Enter email address, check to agree to Terms and Privacy Policy, and click the “SIGN UP” button. Copyright Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Centrify: Link

Goal Reached Thanks to every supporter — we hit 100%!

Themify Builder <= 7.8.0 Missing Authorization Arbitrary Data Modification via AJAX (CVE-2026-75027)

More from this source