CVE-2026-107887 Advanced Twenty Seventeen CVE debrief

Who should care

WordPress administrators, security teams, and users with subscriber or higher privileges should assess exposure and verify the presence of this plugin to prevent unauthorized theme changes and CSRF attacks. Defenders should prioritize verifying the presence of this plugin and assessing user authentication configurations to mitigate potential impacts on site-wide theme configurations and user security.

Why it matters

Defenders should care about CVE-2026-107887 because it allows authenticated users to switch the site's active theme and trigger CSRF attacks, potentially impacting site-wide theme configurations and user security.

• Potential unauthorized theme changes by authenticated users
• CSRF attacks against logged-in users, including administrators
• Required verification of user authentication configurations
• Potential impact on site-wide theme configurations

Technical summary

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 is vulnerable to unauthorized theme changes and CSRF attacks due to lacking capability and nonce checks. This allows any authenticated user, such as a subscriber, to switch the site's active theme site-wide and trigger CSRF attacks against any logged-in user, including administrators. The vulnerability impacts site-wide theme configurations and user security, emphasizing the need for defenders to verify the presence of this plugin and assess user authentication configurations.

Defensive priority

Defenders should prioritize verifying the presence of this plugin and assessing user authentication configurations.

Recommended defensive actions

• Verify the presence of the Advanced Twenty Seventeen WordPress plugin version 1.3.1 or earlier
• Assess user authentication configurations to prevent unauthorized theme changes
• Implement CSRF protection for WordPress installations
• Monitor for suspicious theme changes and user activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CS.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.