CVE-2026-107887: CWE-862 Missing Authorization in Advanced Twenty Seventeen

CVE-2026-107887 describes a missing authorization (CWE-862) and CSRF (CWE-352) vulnerability in the Advanced Twenty Seventeen WordPress plugin versions up to 1.3.1. The plugin does not verify user capabilities or use nonce checks when performing the action that creates and activates its bundled child theme. This flaw permits any authenticated user, such as a subscriber, to switch the site's active theme site-wide. Furthermore, the lack of CSRF protection allows attackers to force this action on any logged-in user, including administrators, potentially altering the site's appearance or behavior without proper authorization.

An attacker with any authenticated user account can change the site's active theme, which could lead to unauthorized site modifications or disruptions. The CSRF vulnerability increases the risk by allowing attackers to perform this action without the victim's consent, including against administrators. While this does not directly lead to code execution or data leakage, it compromises site integrity and control over the site's presentation and functionality.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Implementing additional web application firewall (WAF) rules to block unauthorized theme activation requests may help mitigate risk.