---
id: "CVE-2026-107887"
kind: "vulnerability"
aliases: ["CVE-2026-107887"]
title: "Advanced Twenty Seventeen WordPress plugin: missing checks let users switch site theme"
severity: "high"
cvss: null
epss: 0.00128
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-24T06:16:35+00:00"
first_seen_at: "2026-10-24T06:47:03+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107887", "first_seen_at": "2026-10-24T06:47:03+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107887", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Advanced Twenty Seventeen WordPress plugin: missing checks let users switch site theme

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 performs no capability or nonce check on the action that creates and activates its bundled child theme. Any logged-in user, including a subscriber, can switch the site's active theme, and an administrator can be tricked into doing so via CSRF.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `advanced-twenty-seventeen` plugin is installed and its version is `1.3.1` or earlier (WordPress admin > Plugins, or `wp plugin get advanced-twenty-seventeen --field=version`)
- Unknown whether a patched version exists; the sources do not say

## Fix

- Deactivate and remove the Advanced Twenty Seventeen plugin, or restrict access to logged-in users you trust until a fixed version is confirmed
- unknown whether a fixed version is available

## Timeline

- 2026-10-24T06:47:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107887
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107887

## From the sources

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active  site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_