File Upload Vulnerability in Brizy Page Builder Plugin for WordPress
CVE-2025-4370
5.3MEDIUM
What is CVE-2025-4370?
The Brizy Page Builder plugin for WordPress is exposed to a file upload vulnerability due to insufficient authorization checks in the process_external_asset_urls function, combined with inadequate path validation in the store_file function. This allows unauthenticated attackers to exploit the weakness, enabling them to upload .TXT files to the server hosting the affected site. As a result, this can lead to further potential exploitation of the server environment.
Affected Version(s)
Brizy – Page Builder * <= 2.6.20
References
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Michael Mazzolini