WordPress security changelog
MEDIUM CVE-2026-7726 Deferred

Layouts for WPBakery public sync permits forced vendor requests and database writes

Layouts for WPBakery through 1.1.3 registers wp_ajax_nopriv_handle_sync for logged-out visitors. Layouts_WPB_Remote::template_sync() performs no nonce, capability or rate check before requesting the fixed vendor API paths /wp-json/layoutsforwpbakery/v1/templates and /categories and writing their decoded responses to transients in wp_options. An unauthenticated attacker can force outbound vendor traffic and repeated database writes at an attacker-selected rate. The record does not describe arbitrary-host SSRF and does not disclose the triggering parameters or transient names.

CVE / CNA score 6.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Layouts for WPBakery
Plugin slug
layouts-for-wpbakery
Affected
<= 1.1.3
Safe version
> 1.1.3
Published
Aug 05, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Aug 05, 2026 and is one of 1 known issue for this plugin.

What to do

Update, patch or deactivate.

Update Layouts for WPBakery to a release after 1.1.3. The authoritative record links a trunk correction but does not identify the first fixed release. Review excessive sync requests and database growth if the public handler was reachable.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync()` callback registered via `wp_ajax_nopriv_handle_sync` in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (`https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}`) and to write the JSON-decoded responses verbatim into the site's `wp_options` table via `set_transient()` — at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

Primary and upstream sources