CVE-2026-14195
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Brizy WordPress plugin before version 2.8.18 does not properly verify authorization on a request handler before returning post content. Users with the Contributor role or higher can read the content of arbitrary posts, including other users' private, pending, and draft posts.
Risk Assessment
Risk of disclosure of sensitive content, including unpublished or private posts, to unauthorized users.
Recommendation
Update the Brizy plugin to version 2.8.18 or later.
Original NVD description (English source)
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.