Vulnerability · Published Oct 20, 2023 · Assigned by Wordfence
CVE-2020-36714Brizy < 1.0.126 - Authorization Bypass to Settings Updates
High 7.4
In plain English
A high-severity security flaw in Brizy – Page Builder from themefusecom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.5%top 55.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| themefusecom | Brizy – Page Builder | 0 – before 1.0.126 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L