{"id":"CVE-2026-112830","kind":"vulnerability","aliases":["CVE-2026-112830"],"related":[],"title":"Brizy: missing authorization lets users reach access-restricted functions","description":"Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25.","summary":"The Brizy WordPress page builder plugin has a missing authorization check, so some actions are not properly restricted to the right users. An attacker with low privileges may be able to perform actions they should not be allowed to.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Brizy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["brizy","package","self-hosted","wordpress"],"not_affected_if":["brizy-not-installed"],"how_to_check":"- Check the installed Brizy plugin version in the WordPress admin plugin list or with `wp plugin get brizy --field=version`\n- Compare the installed version against the fixed range below","fix":"- Brizy: move to a version later than `2.8.25`; the exact fixed version is unknown","status":"open","published_at":"2026-11-13T13:17:48+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","triaged_at":"2026-11-13T13:48:07+00:00","updated_at":"2026-11-13T13:48:07+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T13:48:07Z","model":"claude-haiku-5-5","output":{"fix":"- Brizy: move to a version later than `2.8.25`; the exact fixed version is unknown","reach":"internet","title":"Brizy: missing authorization lets users reach access-restricted functions","impact":"medium","summary":"The Brizy WordPress page builder plugin has a missing authorization check, so some actions are not properly restricted to the right users. An attacker with low privileges may be able to perform actions they should not be allowed to.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","brizy","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users perform restricted actions on the site","analyst_note":"Find the fixed version and the exact affected endpoints or roles in the NVD entry or the Wordfence/vendor advisory for CVE-2026-112830.","how_to_check":"- Check the installed Brizy plugin version in the WordPress admin plugin list or with `wp plugin get brizy --field=version`\n- Compare the installed version against the fixed range below","plain_action":"","product_name":"Brizy","needs_analyst":true,"not_affected_if":["brizy-not-installed"],"who_is_affected":"Sites running the Brizy page builder plugin at version 2.8.25 or earlier, where the flawed actions are reachable. Sites without Brizy installed are not affected. The sources do not describe which roles or endpoints are involved.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4533,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112830':13A,16A '-2026':12A,15A '2.8.25':83C 'abl':53B 'access':8A,73C 'access-restrict':7A 'action':37B,56B 'affect':78C 'allow':61B,69C 'attack':47B 'author':3A,33B,63C 'brizi':1A,18B,25B,66C,67C,68C,79C 'brizy':17A 'builder':28B 'check':34B 'configur':72C 'control':74C 'cve':11A,14A 'exploit':70C 'function':10A 'host':22B 'incorrect':71C 'issu':77C 'let':4A 'levels.this':76C 'low':49B 'may':51B 'miss':2A,32B,62C 'n/a':81C 'packag':19B 'page':27B 'perform':55B 'plugin':29B 'privileg':50B 'proper':40B 'reach':6A 'restrict':9A,41B 'right':44B 'secur':75C 'self':21B 'self-host':20B 'user':5A,45B 'vulner':64C 'wordpress':23B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Brizy page builder plugin at version 2.8.25 or earlier, where the flawed actions are reachable. Sites without Brizy installed are not affected. The sources do not describe which roles or endpoints are involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["brizy"],"ptokens":["brizy"],"labels":["brizy","medium","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-112830':13A,16A '-2026':12A,15A 'access':8A 'access-restrict':7A 'author':3A 'brizi':1A 'brizy':17A 'cve':11A,14A 'function':10A 'let':4A 'miss':2A 'reach':6A 'restrict':9A 'user':5A","search_b":"'abl':53B 'action':37B,56B 'allow':61B 'attack':47B 'author':33B 'brizi':18B,25B 'builder':28B 'check':34B 'host':22B 'low':49B 'may':51B 'miss':32B 'packag':19B 'page':27B 'perform':55B 'plugin':29B 'privileg':50B 'proper':40B 'restrict':41B 'right':44B 'self':21B 'self-host':20B 'user':45B 'wordpress':23B,26B","search_c":"'2.8.25':83C 'access':73C 'affect':78C 'allow':69C 'author':63C 'brizi':66C,67C,68C,79C 'configur':72C 'control':74C 'exploit':70C 'incorrect':71C 'issu':77C 'levels.this':76C 'miss':62C 'n/a':81C 'secur':75C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T13:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112830","severity":null,"published_at":"2026-11-13T13:17:48+00:00","modified_at":"2026-11-13T13:17:48+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","fetched_at":"2026-11-13T13:46:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}