# Themify Builder <= 7.8.2 - Unauthenticated Arbitrary Mailing List Subscription via Optin Module

- **ID:** WPSEC-2026-1147
- **Plugin:** Themify Builder (`themify-builder`), https://wordpress.org/plugins/themify-builder/
- **Affected versions:** all versions before 7.8.3
- **Fixed in:** 7.8.3 (Update to 7.8.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/themify-builder
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1147/

## Description

The Themify Builder plugin for WordPress is vulnerable to Improper Input Validation via the Optin module's tb_optin_subscribe AJAX action in all versions up to, and including, 7.8.2. This is due to the handler building the provider, list or form ID and double opt-in setting from user-supplied tb_optin_* POST parameters instead of the settings stored for the module. This makes it possible for unauthenticated attackers to subscribe arbitrary e-mail addresses to any list, audience or form in the mail service accounts configured on the site, and to skip the double opt-in confirmation the site owner turned on.

## References

- https://wpsec.com/vuln/WPSEC-2026-1147/
- https://plugins.svn.wordpress.org/themify-builder/tags/7.8.3/
- https://wordpress.org/plugins/themify-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1147/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.