CVE-2026-15407 is an authorization bypass vulnerability (CWE-862) in the Themify Builder WordPress plugin affecting all versions up to and including 7.7.7. The plugin fails to properly verify that a user is authorized to perform certain actions, allowing authenticated users with subscriber-level privileges or higher to overwrite or delete generated CSS stylesheet files for arbitrary posts, including private and draft posts owned by other users. Additionally, attackers can modify plugin-scoped font options. The CSRF nonce (tf_nonce) required for these actions is exposed on public front-end builder pages via wp_localize_script, making it easily accessible to any authenticated user visiting such pages. This vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity.

An attacker with subscriber-level or higher authenticated access can modify or delete CSS files associated with any post, including private and draft posts owned by other users, potentially affecting site appearance or functionality. They can also alter font settings scoped to the plugin. There is no direct confidentiality or availability impact reported. The vulnerability does not require user interaction beyond visiting a public front-end builder page to obtain the CSRF nonce.

No official patch or remediation level has been confirmed as of the published date. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, restricting subscriber-level access and limiting authenticated user capabilities may reduce risk. Since the CSRF nonce is exposed on public pages, no workaround fully mitigates the issue without a patch. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.