{
 "id": "WPSEC-2026-2157",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2157/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2157/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2157/index.md",
 "title": "Themify Builder <= 7.8.4 - Missing Authorization to Unauthenticated Stylesheet Injection via 'tb_generate_on_fly' AJAX Action",
 "description": "The Themify Builder plugin for WordPress is vulnerable to unauthorized modification of data via the 'tb_generate_on_fly' AJAX action in all versions up to, and including, 7.8.4. This is due to a missing capability check that let users without the edit_post capability have their CSS written to disk when a post's generated stylesheet was missing, combined with insufficient validation of submitted selectors, which allowed at-rules and selectors targeting html, body and :root. This makes it possible for unauthenticated attackers to inject arbitrary CSS into a post's stored stylesheet, which is then served to site visitors and can be used to deface pages. Exploitation requires that the post's generated stylesheet be missing, for example after regeneration or deletion.",
 "plugin": {
  "slug": "themify-builder",
  "name": "Themify Builder",
  "full_name": "Themify Builder",
  "wordpress_org": "https://wordpress.org/plugins/themify-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/themify-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/themify-builder"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.8.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.8.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.8.5",
 "remediation": "Update to 7.8.5 or later.",
 "fix_released": "2026-10-29T21:34:01+00:00",
 "published": "2026-10-30T21:40:51+00:00",
 "updated": "2026-10-30T09:24:41.335531+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2157/",
  "https://plugins.svn.wordpress.org/themify-builder/tags/7.8.5/",
  "https://wordpress.org/plugins/themify-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/themify-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}