Authorization Flaw in Brizy WordPress Plugin Affects Template Management
CVE-2026-16070
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16070?
The Brizy WordPress plugin versions prior to 2.8.19 contains a significant authorization flaw. This vulnerability enables users with Contributor-level access and higher to improperly modify the template-type assignments of templates that they do not own. The plugin fails to accurately verify the authorization status of requests before updating crucial template metadata, allowing malicious actors to exploit this oversight and alter settings without proper permissions.
Affected Version(s)
Brizy 0 < 2.8.19
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.