# Themify Builder <= 7.8.4 - Missing Authorization to Unauthenticated Stylesheet Injection via 'tb_generate_on_fly' AJAX Action

- **ID:** WPSEC-2026-2157
- **Plugin:** Themify Builder (`themify-builder`), https://wordpress.org/plugins/themify-builder/
- **Affected versions:** all versions before 7.8.5
- **Fixed in:** 7.8.5 (Update to 7.8.5 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/themify-builder
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2157/

## Description

The Themify Builder plugin for WordPress is vulnerable to unauthorized modification of data via the 'tb_generate_on_fly' AJAX action in all versions up to, and including, 7.8.4. This is due to a missing capability check that let users without the edit_post capability have their CSS written to disk when a post's generated stylesheet was missing, combined with insufficient validation of submitted selectors, which allowed at-rules and selectors targeting html, body and :root. This makes it possible for unauthenticated attackers to inject arbitrary CSS into a post's stored stylesheet, which is then served to site visitors and can be used to deface pages. Exploitation requires that the post's generated stylesheet be missing, for example after regeneration or deletion.

## References

- https://wpsec.com/vuln/WPSEC-2026-2157/
- https://plugins.svn.wordpress.org/themify-builder/tags/7.8.5/
- https://wordpress.org/plugins/themify-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2157/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.