CVE-2026-16070 in Brizy Plugin
Summary
by MITRE • 08/04/2026
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The Brizy WordPress plugin vulnerability represents a critical authorization bypass flaw that undermines the security model of content management systems. This issue affects versions prior to 2.8.19 and stems from improper validation of user permissions during template modification operations. The vulnerability specifically manifests when the plugin processes requests to update template type meta information, where it fails to consistently verify authorization across different request parameters. This inconsistency creates a pathway for attackers to manipulate template assignments without proper administrative privileges.
The technical flaw resides in the plugin's insufficient input validation and authorization checking mechanisms. When a user submits a request to modify a template's type meta, the system validates one parameter while using a different parameter during the actual write operation. This discrepancy allows malicious actors with contributor-level access or higher to exploit the gap by crafting requests that bypass normal permission checks. The vulnerability essentially creates a mismatch between what the system believes is being modified and what actually occurs, enabling unauthorized template ownership transfers.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables attackers to manipulate the structural components of websites built with Brizy. Contributors and above can potentially reassign templates owned by other users, which could lead to content manipulation, unauthorized modifications, or even the creation of malicious template configurations that affect site functionality. This authorization bypass could allow threat actors to establish persistent access patterns or create misleading content structures that compromise site integrity and user trust.
From a cybersecurity perspective, this vulnerability aligns with CWE-862, which addresses insufficient authorization checks in software systems. The flaw also relates to ATT&CK technique T1078.004, which covers legitimate credentials usage through privilege escalation. Organizations using Brizy plugin versions prior to 2.8.19 face significant risk of unauthorized template manipulation that could compromise website security and content integrity. Security professionals should prioritize immediate patching of affected installations and implement additional monitoring for unusual template modification patterns.
Mitigation strategies should include immediate deployment of the patched Brizy version 2.8.19 or later, which addresses the authorization validation discrepancy. Network administrators should also implement monitoring solutions to detect anomalous template modification activities and establish proper access controls that limit template editing capabilities to authorized administrators only. Additional defensive measures might involve implementing web application firewalls with rules specifically designed to block suspicious parameter manipulation attempts and conducting regular security audits of plugin configurations to ensure proper authorization enforcement throughout the WordPress ecosystem.