CVE-2025-58594
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Brizy plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.7.12.
Risk Assessment
An attacker could gain unauthorized access to administrative functions, potentially leading to full site compromise.
Recommendation
Update the Brizy plugin to the latest available version that includes the security fix.
Other vulnerabilities in Brizy
See all- CVE-2026-16069Medium
The Brizy WordPress plugin before version 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box. Users with the Contributor role or above can inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
- CVE-2026-14195Low
The Brizy WordPress plugin before version 2.8.18 does not properly verify authorization on a request handler before returning post content. Users with the Contributor role or higher can read the content of arbitrary posts, including other users' private, pending, and draft posts.
Original NVD description (English source)
Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS