PT-2025-31165 · WordPress · Brizy – Page Builder

Michael Mazzolini · Published 2025-07-29 · Updated 2025-08-14 · CVE-2025-4370

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Brizy – Page Builder plugin for WordPress versions up to and including 2.6.20

Description The Brizy – Page Builder plugin for WordPress is susceptible to limited file uploads due to missing authorization in the process external asset urls() function and missing path validation in the store file() function. This allows unauthenticated attackers to upload .TXT files to the affected site’s server.

Recommendations Update Brizy – Page Builder plugin to a version later than 2.6.20. As a temporary workaround, restrict access to the process external asset urls() function. As a temporary workaround, restrict access to the store file() function.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-4370

Affected Products

Brizy – Page Builder

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-4370 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4370 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/db18f6b4-600d-4c63-a9f2-4e3b8ab4fba3?source=cve · Note
• https://plugins.trac.wordpress.org/browser/brizy/tags/2.6.17/editor/asset/static-file-trait.php#L44 · Note
• https://t.me/CVEtracker/28636 · Telegram Post
• https://plugins.trac.wordpress.org/browser/brizy/tags/2.6.17/editor/asset/media-processor.php#L27 · Note
• https://t.me/cveNotify/130097 · Telegram Post
• https://twitter.com/CVEnew/status/1950051909336707433 · Twitter Post
• https://twitter.com/jmdevlabs/status/1955989293911929343 · Twitter Post