Back Ciberseguridadlatam

Falla en plugin de WordPress permite a visitantes anónimos alterar diseño de posts privados

Ciberseguridadlatam •Redacción CSL • August 24, 2026

CVE-2026-75027 expone cómo un nonce público convierte una verificación de seguridad en puerta abierta para modificar estilos en cualquier contenido. Una vulnerabilidad de bypass de autorización en Themify Builder — plugin de construcción visual para WordPress instalado en cientos de miles de sitios — permite que cualquier visitante no autenticado modifique datos de estilos almacenados […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WordPress Plugin Vulnerability Allows Unauthorized Style Modifications A critical vulnerability (CVE-2026-75027) in the Themify Builder plugin for WordPress has been disclosed, allowing unauthorized users to alter the styles of private posts. This issue arises from a public nonce that bypasses security checks, exposing hundreds of thousands of sites to potential manipulation. The vulnerability affects sites using the Themify Builder plugin, which is widely installed. As of August 22, 2026, the CVE has been published, but there is no indication of active exploitation at this time. Site administrators are advised to review their installations and apply necessary updates once available. 2 sources 55

Extracted Entities

Falla en plugin de WordPress permite a visitantes anónimos alterar diseño de posts privados

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)