{"id":"CVE-2026-107887","kind":"vulnerability","aliases":["CVE-2026-107887"],"related":[],"title":"Advanced Twenty Seventeen WordPress plugin: missing checks let users switch site theme","description":"The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active  site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.","summary":"The Advanced Twenty Seventeen WordPress plugin through 1.3.1 performs no capability or nonce check on the action that creates and activates its bundled child theme. Any logged-in user, including a subscriber, can switch the site's active theme, and an administrator can be tricked into doing so via CSRF.","severity":"high","cvss":null,"epss":0.00128,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `advanced-twenty-seventeen` plugin is installed and its version is `1.3.1` or earlier (WordPress admin > Plugins, or `wp plugin get advanced-twenty-seventeen --field=version`)\n- Unknown whether a patched version exists; the sources do not say","fix":"- Deactivate and remove the Advanced Twenty Seventeen plugin, or restrict access to logged-in users you trust until a fixed version is confirmed\n- unknown whether a fixed version is available","status":"open","published_at":"2026-10-24T06:16:35+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:52:01+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:52:01Z","model":"claude-haiku-5-5","output":{"fix":"- Deactivate and remove the Advanced Twenty Seventeen plugin, or restrict access to logged-in users you trust until a fixed version is confirmed\n- unknown whether a fixed version is available","reach":"internet","title":"Advanced Twenty Seventeen WordPress plugin: missing checks let users switch site theme","impact":"medium","summary":"The Advanced Twenty Seventeen WordPress plugin through 1.3.1 performs no capability or nonce check on the action that creates and activates its bundled child theme. Any logged-in user, including a subscriber, can switch the site's active theme, and an administrator can be tricked into doing so via CSRF.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker switches the site's active theme and can hijack administrators via CSRF.","analyst_note":"Confirm the patched version and whether the plugin is still maintained; check the NVD entry and WordPress plugin page for a fix.","how_to_check":"- Check whether the `advanced-twenty-seventeen` plugin is installed and its version is `1.3.1` or earlier (WordPress admin > Plugins, or `wp plugin get advanced-twenty-seventeen --field=version`)\n- Unknown whether a patched version exists; the sources do not say","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Advanced Twenty Seventeen plugin through 1.3.1 are exposed, since any logged-in account, including the lowest-privilege subscriber role, can reach the vulnerable action. Sites that do not have the plugin installed are not affected. Sites with no user registration and no logged-in users have a smaller exposure, but CSRF still applies to administrators.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":3331,"output_tokens":670,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107887':15A,18A '-2026':14A,17A '1.3.1':31B,82C 'action':40B,93C,122C 'activ':44B,62B,97C,114C 'administr':66B,134C 'advanc':1A,25B,76C 'allow':101C,119C 'authent':103C 'bundl':46B,99C 'capabl':34B,87C 'check':7A,37B,90C 'child':47B,100C 'creat':42B,95C 'csrf':74B,136C 'cve':13A,16A 'host':22B 'includ':54B,132C 'let':8A 'log':51B,129C 'logged-in':50B,128C 'miss':6A 'nonc':36B,89C 'packag':19B 'perform':32B,85C 'plugin':5A,29B,80C 'self':21B 'self-host':20B 'seventeen':3A,27B,78C 'site':11A,60B,112C,116C 'site-wid':115C 'subscrib':56B,108C 'switch':10A,58B,110C 'theme':12A,48B,63B 'trick':69B 'trigger':125C 'twenti':2A,26B,77C 'user':9A,53B,104C,131C 'via':73B,135C 'wide':117C 'wordpress':4A,23B,28B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Twenty Seventeen plugin through 1.3.1 are exposed, since any logged-in account, including the lowest-privilege subscriber role, can reach the vulnerable action. Sites that do not have the plugin installed are not affected. Sites with no user registration and no logged-in users have a smaller exposure, but CSRF still applies to administrators.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107887","severity":null,"published_at":"2026-10-24T06:16:35+00:00","modified_at":"2026-10-24T06:16:35+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107887","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107887","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}