Themify Builder: PHP Object Injection by authenticated Contributor users
Summary
Themify Builder, a WordPress plugin, up to and including version 7.8.1 is vulnerable to PHP Object Injection caused by unsafe deserialization of untrusted data (CWE-502). An authenticated user with Contributor rights can exploit it, and the CVSS base score is 8.8 with high impact on confidentiality, integrity and availability. Exploitation depends on the site's user roles and on the installed plugins and themes, so real-world impact varies. Patchstack reports version 7.8.2 as the patched version.
Affected
- Themify Builder (WordPress plugin) versions up to and including 7.8.1
- Required privilege: Contributor
Fixed in
- Version 7.8.2 (per Patchstack)
- Vendor confirmation of the fix: Unknown.
Workaround
- Unknown. No vendor or CVE-specific workaround confirmed.
- Restrict or remove Contributor-level accounts where not needed.
Exploitation
- Exploited in the wild: No evidence found.
- Public proof of concept: None found.
- CISA SSVC: Exploitation none, not automatable.
- Patchstack describes the vulnerability as expected to become exploited and used in mass-exploit campaigns.
- EPSS: 0.00355 (Tenable).
Our recommendation
- Identify all sites running Themify Builder and check the installed version.
- Update to version 7.8.2 or later, and confirm against the Patchstack advisory that the installed release contains the fix.
- Review Contributor and higher accounts, remove unneeded ones, and audit their recent content changes.
- Monitor for suspicious PHP object activity and plugin-related alerts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Tenable CVE-2026-96831 www.tenable.com
- WordPress.org Themify Builder wordpress.org
- CVE Threatint CVE-2026-96831 cve.threatint.com
- Strix CVE-2026-96831 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:10.
Original description (NVD)
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.