Brizy – Page Builder <= 2.8.25 - Unauthenticated Sensitive Information Exposure via 'brizy_post' Parameter
- ID
- WPSEC-2026-2899
- Plugin
- Brizy – Page Builder (brizy)
- Affected
- all versions before 2.8.26
- Remediation
- Update to 2.8.26 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Brizy – Page Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Brizy plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'brizy_post' and 'post' request parameters in all versions up to, and including, 2.8.25. This is due to the front-end preview handler (Brizy_Editor::handleEditorPreviewMode) taking the post to render from user-supplied request parameters when the main query is not a single post, such as on the home page, archives, search results or 404 pages. The only check is a status check that blocks draft, pending, private and scheduled posts, and any user with Brizy editing access passes it. This makes it possible for unauthenticated attackers to view the compiled Brizy content of posts they should not be able to see, such as password-protected or trashed posts and Brizy content stored in non-public post types. Authenticated users with Brizy editing access can also view other users' draft, pending, private and scheduled Brizy posts.
References
- https://wpsec.com/vuln/WPSEC-2026-2899/
- https://plugins.svn.wordpress.org/brizy/tags/2.8.26/
- https://wordpress.org/plugins/brizy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS