Brizy < 1.0.126 - Authorization Bypass to Settings Updates
43Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 7.4epss 0.4%
from disclosure to weapon
Published on NVDOct 20
VulnCheckJun 3
exploitation probability
0.4%top 65% of all CVEs
observed exploitation
yesVulnCheck
The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected products
themefusecom · Brizy – Page Builder