# Brizy – Page Builder <= 2.8.25 - Unauthenticated Sensitive Information Exposure via 'brizy_post' Parameter

- **ID:** WPSEC-2026-2899
- **Plugin:** Brizy – Page Builder (`brizy`), https://wordpress.org/plugins/brizy/
- **Affected versions:** all versions before 2.8.26
- **Fixed in:** 2.8.26 (Update to 2.8.26 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/brizy
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2899/

## Description

The Brizy plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'brizy_post' and 'post' request parameters in all versions up to, and including, 2.8.25. This is due to the front-end preview handler (Brizy_Editor::handleEditorPreviewMode) taking the post to render from user-supplied request parameters when the main query is not a single post, such as on the home page, archives, search results or 404 pages. The only check is a status check that blocks draft, pending, private and scheduled posts, and any user with Brizy editing access passes it. This makes it possible for unauthenticated attackers to view the compiled Brizy content of posts they should not be able to see, such as password-protected or trashed posts and Brizy content stored in non-public post types. Authenticated users with Brizy editing access can also view other users' draft, pending, private and scheduled Brizy posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-2899/
- https://plugins.svn.wordpress.org/brizy/tags/2.8.26/
- https://wordpress.org/plugins/brizy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2899/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.