Brizy Contributors can reassign other users' template types
Brizy before 2.8.19 authorizes an object-modification request against one parameter but uses a different attacker-controlled object identifier for the template-type metadata write. A Contributor can exploit that mismatch to change the template-type assignment of templates owned by other users. The public advisory does not disclose the endpoint, action, checked parameter, written parameter, metadata key or update function.
- Component
- Brizy
- Plugin slug
brizy- Affected
- < 2.8.19
- Safe version
2.8.19- Published
- Aug 04, 2026
This CVE was published Aug 04, 2026 and is one of 34 known issues for this plugin.
Update, patch or deactivate.
Update Brizy to 2.8.19 or later. Review template-type assignments and changes submitted by delegated authors, restoring unauthorized modifications from trusted configuration records.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N