File Upload Vulnerability in Brizy Page Builder Plugin for WordPress

CVE-2025-4370

What is CVE-2025-4370?

The Brizy Page Builder plugin for WordPress is exposed to a file upload vulnerability due to insufficient authorization checks in the process_external_asset_urls function, combined with inadequate path validation in the store_file function. This allows unauthenticated attackers to exploit the weakness, enabling them to upload .TXT files to the server hosting the affected site. As a result, this can lead to further potential exploitation of the server environment.

References