Live › vulnerability › CVE-2026-107887
Go to dashboardThe Advanced Twenty Seventeen WordPress plugin through 1.3.1 performs no capability or nonce check on the action that creates and activates its bundled child theme. Any logged-in user, including a subscriber, can switch the site's active theme, and an administrator can be tricked into doing so via CSRF.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the Advanced Twenty Seventeen plugin through 1.3.1 are exposed, since any logged-in account, including the lowest-privilege subscriber role, can reach the vulnerable action. Sites that do not have the plugin installed are not affected. Sites with no user registration and no logged-in users have a smaller exposure, but CSRF still applies to administrators.
No product ranges from the sources yet.
advanced-twenty-seventeen plugin is installed and its version is 1.3.1 or earlier (WordPress admin > Plugins, or wp plugin get advanced-twenty-seventeen --field=version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
This page as .md · .json · in your agent: get_signal("CVE-2026-107887")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.