CVE-2026-7726 describes a missing authorization vulnerability (CWE-862) in the Layouts for WPBakery plugin for WordPress. The issue exists in the template_sync callback registered via wp_ajax_nopriv_handle_sync, which lacks capability checks, nonce verification, and rate limiting. As a result, unauthenticated attackers can trigger outbound HTTP requests to the vendor's external API endpoints and write the JSON-decoded responses verbatim into the WordPress wp_options table using set_transient(). This affects all plugin versions up to and including 1.1.3.

The vulnerability allows unauthenticated attackers to perform unauthorized actions that can modify the site's wp_options table, potentially impacting data integrity and site availability. There is no confidentiality impact reported. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts limited to integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published at this time. Until a patch is available, site administrators should consider disabling or removing the vulnerable plugin version or restricting access to the affected AJAX endpoint if possible.