Themify Builder <= 7.8.4 - Missing Authorization to Unauthenticated Stylesheet Injection via 'tb_generate_on_fly' AJAX Action
- ID
- WPSEC-2026-2157
- Plugin
- Themify Builder (themify-builder)
- Affected
- all versions before 7.8.5
- Remediation
- Update to 7.8.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Themify Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Themify Builder plugin for WordPress is vulnerable to unauthorized modification of data via the 'tb_generate_on_fly' AJAX action in all versions up to, and including, 7.8.4. This is due to a missing capability check that let users without the edit_post capability have their CSS written to disk when a post's generated stylesheet was missing, combined with insufficient validation of submitted selectors, which allowed at-rules and selectors targeting html, body and :root. This makes it possible for unauthenticated attackers to inject arbitrary CSS into a post's stored stylesheet, which is then served to site visitors and can be used to deface pages. Exploitation requires that the post's generated stylesheet be missing, for example after regeneration or deletion.
References
- https://wpsec.com/vuln/WPSEC-2026-2157/
- https://plugins.svn.wordpress.org/themify-builder/tags/7.8.5/
- https://wordpress.org/plugins/themify-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS