CVE-2026-7726 describes a missing authorization (CWE-862) vulnerability in the Layouts for WPBakery plugin for WordPress. The vulnerability exists in the `Layouts_WPB_Remote::template_sync()` callback registered via `wp_ajax_nopriv_handle_sync`, which lacks any capability checks or nonce verification. As a result, unauthenticated attackers can force the WordPress server to make outbound HTTP requests to the plugin vendor's external API endpoints and write the JSON-decoded responses verbatim into the site's wp_options table using `set_transient()`. This can be exploited without any user interaction or privileges, potentially leading to integrity and availability impacts on the affected site.

The vulnerability allows unauthenticated attackers to perform unauthorized actions by forcing the server to fetch and store external data into the WordPress options table. While confidentiality is not impacted, the integrity of site data can be compromised, and availability may be affected due to manipulation of transient options. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, site administrators should consider disabling or removing the Layouts for WPBakery plugin if not essential, or restrict access to the AJAX endpoint if possible. Monitor vendor channels for updates and apply patches promptly once released.