---
id: "CVE-2026-112830"
page: "https://infrastack.ai/live/CVE-2026-112830"
kind: "vulnerability"
aliases: ["CVE-2026-112830"]
title: "Brizy: missing authorization lets users reach access-restricted functions"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Brizy", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["brizy", "package", "self-hosted", "wordpress"]
not_affected_if: ["brizy-not-installed"]
published_at: "2026-11-13T13:17:48+00:00"
first_seen_at: "2026-11-13T13:46:51+00:00"
updated_at: "2026-11-13T13:48:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112830", "first_seen_at": "2026-11-13T13:46:51+00:00"}]
exploit_sources: []
---

# Brizy: missing authorization lets users reach access-restricted functions

Link for people: https://infrastack.ai/live/CVE-2026-112830 (this .md is for agents)

The Brizy WordPress page builder plugin has a missing authorization check, so some actions are not properly restricted to the right users. An attacker with low privileges may be able to perform actions they should not be allowed to.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Brizy affected range not listed fixed no fixed version listed

## How to check

- Check the installed Brizy plugin version in the WordPress admin plugin list or with `wp plugin get brizy --field=version`
- Compare the installed version against the fixed range below

## Fix

- Brizy: move to a version later than `2.8.25`; the exact fixed version is unknown

## Timeline

- 2026-11-13T13:46:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112830

## From the sources

Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_