high7.1
CVE-2021-38345
The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-ad…
Impact
The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Brizy | Brizy-Page Builder | before 1.0.1.126 from 1.0.127 through 2.3.11 |