Executive brief
The Brizy Page Builder plugin for WordPress, which is used to design and build website layouts, contains a security flaw in how it handles content requests. This vulnerability allows users with low-level access, such as guest contributors, to view private, pending, or draft posts that they should not be able to see. This could lead to the unauthorized disclosure of sensitive information or unpublished company content.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Brizy WordPress plugin's 'get_post_info' request handler. The component fails to perform adequate authorization checks to ensure the requesting user has the permissions required to view the specific post ID provided. An authenticated attacker with at least Contributor-level privileges can exploit this by sending crafted requests to access sensitive post data, including drafts and private content belonging to other users. The issue is addressed in version 2.8.18.
Affected products
- Brizy Brizy – Page Builder < 2.8.18
Timeline
- 2026-07-20: disclosed: Publicly published by WPScan
- 2026-08-01: advisory: CVE published to NVD dataset
- 2026-08-03: other: Scheduled Proof of Concept release date