CVE-2021-38345: Brizy Brizy-Page Builder

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127.

Affected products

• Brizy Brizy-Page Builder: before 1.0.1.126 (fixed in 1.0.1.126); from 1.0.127, up to and including 2.3.11

Published 2021-10-14. Last modified 2026-06-17.