CVE-2026-75027

{"id": "CVE-2026-75027", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75027", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T12:43:10.162003Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "themifyme", "product": "Themify Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.8.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-22T04:18:15.057", "references": [{"url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/classes/class-themify-builder-stylesheet.php#L69", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/classes/class-themify-builder.php#L227", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/classes/class-themify-builder.php#L518", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.7.6/classes/class-themify-builder.php#L693", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.0/classes/class-themify-builder-stylesheet.php#L69", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.0/classes/class-themify-builder.php#L227", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.0/classes/class-themify-builder.php#L518", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.0/classes/class-themify-builder.php#L693", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3653841%40themify-builder&new=3653841%40themify-builder", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1892207-0e51-4b2e-bc71-d6a0111b7041?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place."}, {"lang": "es", "value": "El plugin Themify Builder para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 7.8.0, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para realizar una acci\u00f3n. Esto hace posible que atacantes no autenticados modifiquen los datos de estilo almacenados de Themify Builder (propiedades de relleno y margen) de publicaciones arbitrarias, incluyendo publicaciones privadas y borradores, al proporcionar un ID de publicaci\u00f3n controlado por el atacante y una carga \u00fatil de estilo JSON. El nonce requerido por el gestor se emite autom\u00e1ticamente a todas las p\u00e1ginas de frontend renderizadas por el constructor a trav\u00e9s de wp_localize_script, lo que significa que cualquier visitante no autenticado puede recuperar trivialmente un nonce v\u00e1lido del c\u00f3digo fuente de la p\u00e1gina y satisfacer el \u00fanico control de acceso existente."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "security@wordfence.com"}