CVE-2025-0969
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The Brizy – Page Builder plugin for WordPress up to version 2.7.16 is vulnerable to Sensitive Information Exposure via the get_users() function. This allows authenticated attackers with Contributor-level access or above to extract sensitive data including email addresses and hashed passwords of administrators.
Risk Assessment
Exposure of administrator passwords (even hashed) can lead to brute-force attacks or other password cracking methods, potentially resulting in administrator account takeover.
Recommendation
It is recommended to update the Brizy plugin to a version newer than 2.7.16 that includes a fix restricting access to user data.
Other vulnerabilities in Brizy – Page Builder
See all- CVE-2026-14882Medium
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to and including 2.8.18 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute whenever a user visits the injected page.
- CVE-2026-2585Medium
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rootAttributes' parameter in all versions up to and including 2.8.14 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page.
Original NVD description (English source)
The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including email addresses and hashed passwords of administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS