CVE-2026-15407 is an authorization bypass vulnerability (CWE-862) in the Themify Builder WordPress plugin affecting all versions up to and including 7.7.7. The plugin fails to properly verify that a user is authorized to perform certain actions, allowing authenticated users with subscriber-level privileges or higher to overwrite or delete generated CSS stylesheet files of arbitrary posts, including private and draft posts owned by other users. Additionally, attackers can modify plugin-scoped font options. The required CSRF nonce (tf_nonce) is exposed on public front-end builder pages via wp_localize_script, making it easily accessible to any authenticated user visiting such a page. This vulnerability does not require user interaction beyond being authenticated and visiting a page where the nonce is exposed.

An attacker with subscriber-level or higher access can modify or delete CSS files associated with posts they do not own, including private and draft posts, potentially affecting site appearance or functionality. They can also alter font options scoped to the plugin. There is no direct confidentiality or availability impact reported, but integrity of site content and presentation can be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to CSS file modifications. Avoid granting unnecessary authenticated access to untrusted users. Follow updates from the Themifyme vendor for patches addressing this authorization bypass.