WordPress Plugin Vulnerabilities

Brizy - Page Builder < 1.0.126 - Improper Access Controls on AJAX Calls

Description

The plugin does not properly check for access controls on AJAX calls, resulting in authenticated user with low privileges being able to gain access to the editor functions.

Affects Plugins

Plugin icon
brizy
Fixed in 1.0.126

References

CVE
CVE-2020-36714
URL
https://blog.nintechnet.com/wordpress-brizy-page-builder-plugin-fixed-critical-vulnerabilities/

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.3 (high)

Miscellaneous

Original Researcher
Jerome Bruandet (nintechnet.com)
Verified
No
WPVDB ID
03b9c219-6cbc-4735-8bea-041a27212c31

Timeline

Publicly Published
2020-06-10 (about 5 years ago)
Added
2020-06-10 (about 5 years ago)
Last Updated
2023-11-03 (about 2 years ago)

Other

Published
Title
Published
2024-10-09
Title
UserPlus <= 2.0 - Unauthenticated Privilege Escalation
Published
2022-12-12
Title
iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin
Published
2026-01-22
Title
Institutions Directory <= 1.3.4 - Subscriber+ Privilege Escalation
Published
2023-08-08
Title
Biometric Login for WooCommerce < 1.0.4 - Unauthenticated Privilege Escalation
Published
2021-04-14
Title
Plus Addons for Elementor < 2.0.7 - Contributor+ Privilege Escalation