VYPR
← All advisories
High severity7.1NVD Advisory· Published Oct 14, 2021· Updated Jun 17, 2026

CVE-2021-38345

CVE-2021-38345

Description

The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127.

Affected products

4
  • Brizy/Brizy Page Builder3 versions
    cpe:2.3:a:brizy:brizy-page_builder:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:brizy:brizy-page_builder:*:*:*:*:*:*:*:*range: >=1.0.127,<=2.3.11
    • cpe:2.3:a:brizy:brizy-page_builder:*:*:*:*:wordpress:*:*:*range: <1.0.1.126
    • (no CPE)range: 2.3.11
  • WordPress/Brizy Page Builderllm-fuzzy
    Range: <=2.3.11, <=1.0.125, >=1.0.127

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.