Medium severity4.3NVD Advisory· Published Feb 26, 2024· Updated Apr 8, 2026

CVE-2024-1165

Description

The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id'. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files to arbitrary locations on the server

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Brizy/Brizy
cpe:2.3:a:brizy:brizy:*:*:*:*:free:wordpress:*:*
Range: <2.4.40
WordPress/Brizyllm-fuzzy
Range: <=2.4.39
Package: https://wordpress.org/plugins/brizy

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3034945/brizy/tags/2.4.41/editor/screenshot/manager.phpnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/7673b2ba-5d7a-4ae9-92e7-1a910687fdb8nvdThird Party Advisory
plugins.trac.wordpress.org/browser/brizy/tags/2.4.39/editor/screenshot/manager.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000