WordPress Plugin Vulnerabilities

Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info

Description

The plugin does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.

Proof of Concept

Affects Plugins

Plugin icon
brizy
Fixed in 2.8.18

References

CVE
CVE-2026-14195

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.1 (low)

Miscellaneous

Original Researcher
Mustafa Ahmed
Submitter
Mustafa Ahmed
Submitter website
https://fortressmssp.com
Verified
Yes
WPVDB ID
2ed270b0-c01e-4615-b365-3455c161a2d9

Timeline

Publicly Published
2026-07-20 (about 13 days ago)
Added
2026-07-20 (about 12 days ago)
Last Updated
2026-07-20 (about 12 days ago)

Other

Published
Title
Published
2023-06-13
Title
WooCommerce Stripe Payment Gateway < 7.4.1 - Unauthenticated PII Disclosure via IDOR
Published
2026-05-12
Title
ilGhera Support System for WooCommerce < 1.3.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Published
2026-03-12
Title
Appointment Booking Calendar < 1.6.10.0 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure
Published
2024-01-16
Title
Display custom fields in the frontend – Post and User Profile Fields < 1.3.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure
Published
2025-05-19
Title
WP Job Portal < 2.3.3 - Unauthenticated Insecure Direct Object Reference