CVE-2026-14195
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Brizy WordPress plugin before version 2.8.18 does not properly verify authorization on a request handler before returning post content. Users with the Contributor role or higher can read the content of arbitrary posts, including other users' private, pending, and draft posts.
Risk Assessment
Risk of disclosure of sensitive content, including unpublished or private posts, to unauthorized users.
Recommendation
Update the Brizy plugin to version 2.8.18 or later.
Other vulnerabilities in Brizy
See all- CVE-2026-16069Medium
The Brizy WordPress plugin before version 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box. Users with the Contributor role or above can inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
- CVE-2025-58594Medium
The Brizy plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.7.12.
Original NVD description (English source)
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS